ISO/IEC 27001-certified
Blnk’s ISMS is certified to ISO/IEC 27001. It defines access control, incident handling, risk treatment, and the review cycle for those controls.
Request certificationOpen-source ledger infrastructure you can trust
-
Blnk Finance is ISO-27001 certified and compliant with GDPR rules and regulations.
-
We ship best practices and tools to maintain security across all levels of our product.
-
Trusted by regulated institutions, public companies, and startups.
Compliance
How Blnk runs its ISMS: ISO/IEC 27001, GDPR, data protection, security training, background checks, access control, and incident response.
GDPR-compliant
Personal data is processed under GDPR. The Privacy Policy covers lawful basis, retention, and subject-access requests.
Data protection
Personal data is classified and accessed on a need-to-know basis. Blnk keeps only what the work requires. For example, a support ticket does not grant access to identity PII unless the role allows it.
Policies and governance
Written policies cover information security, access control, incident response, and business continuity. Management reviews and approves them on a set schedule.
Risk assessments
Blnk assesses risks to confidentiality, integrity, and availability, then tracks remediation until each finding is closed.
Training
All employees at Blnk complete annual security training based on their roles. The information security team also reaches employees through internal email campaigns and gamification.
Background checks
Blnk conducts background checks on all applicants selected for full-time employment, in compliance with local regulations.
Infrastructure
How Blnk isolates production systems, encrypts data in transit and at rest, and controls access to critical services.
Dedicated Production infrastructure
Production runs on dedicated hosts, not shared Sandbox capacity. Customers choose the region their instance runs in at deploy time.
Network isolation
Inbound traffic to a managed instance is limited to the customer IP allowlist. Self-hosted Blnk behind a firewall can also allowlist Blnk’s egress IPs so the dashboard safely reaches the API.
Encryption in transit and at rest
Blnk encrypts data at rest and in transit. Sensitive data at rest, including API keys, is encrypted with AES-256-GCM. Data in transit uses TLS 1.2 or higher.
Access control
Critical services follow password policies. Access is granted only through SSO or multi-factor authentication, where available. The information security team runs periodic user access reviews of authorization and permissions.
Product
An append-only ledger, scoped API keys, workspace roles, multi-factor authentication, PII tokenization, and audit logs.
Immutable ledger
Blnk records transactions as an append-only log. Entries are not updated in place, and identity changes are logged. Balances are reconstructed from that history rather than from a mutable total.
Scoped API keys
Each API key in Blnk is limited in scope. A key can access only certain resources and can perform only certain operations on them (read or write). For example, a payments key can be created that only writes transactions, with no access to ledgers or API keys.
Expiration and revocation
API keys in Blnk can be set to expire, and can be revoked immediately. Lost keys cannot be retrieved. A key is rotated by creating a new key and revoking the old one.
Roles and permissions
Blnk includes built-in roles and permissions for workspace members: Admin, Operator, Investigator, and Analyst. Analyst is read-only. Access is granted on a need-to-know basis, in accordance with least privilege.
Two-factor authentication
Blnk supports multi-factor authentication through TOTP and an authenticator app. Sessions record device, location, and time. A session can be revoked from Security & Access, and a new sign-in sends an email.
PII tokenization
Blnk tokenizes personally identifiable information on identity records so sensitive values are not stored in plaintext. Standard tokens are random, and format-preserving tokens keep the original shape. Detokenization is permissioned and logged.
Audit logs
Blnk collects audit logs for workspace activity: the action, who performed it, and when. Logs cover ledgers, balances, transactions, identities, and anomaly reviews, and are used to review activity and identify unusual or unauthorized actions.
Availability
Availability practices, backups, public status updates, and incident response and management.
Uptime
Blnk maintains uptime targets for systems that handle customer operations. Production is covered by a 99.9% uptime SLA. Sandbox is not covered by an uptime or retention SLA.
High availability and backups
Blnk runs systems with high availability and scheduled backups. Backups are written to disk or S3-compatible storage with server-side encryption, versioning, and a configured retention policy.
Regions
Systems and their backups are kept in the region selected for that environment, so data stays in that region.
Status
Blnk monitors availability and posts incident updates to status.blnkfinance.com as they happen.
Incident response
Blnk maintains incident response and management procedures as part of the ISMS. SEV 1 incidents are covered by 24/7 on-call, and restore procedures are documented. Incident communication can include a dedicated Slack channel.