Security & data handling
Compliance software holds your clients' most sensitive information. Here is how StackGo keeps it safe, keeps the records your regulator expects, and keeps you in control of every decision.
Built to keep the record, and keep you in control
StackGo runs the checks and lands the evidence on the client record, in the software your team already uses and in a secure vault alongside it. The system does the collecting and the filing. The decisions, and the data, stay with you.
How your data is handled
- Your system of record stays clean
Only the contemporaneous note goes back to your practice software: what was checked, when, and the outcome. The personal data behind it does not travel with it. Your audit trail sits where your team works, without importing the liability.
See what lands in each system → - Retention that matches your obligation
The vault keeps the verification record and its supporting documents for as long as your regime requires — seven years under the Australian AML/CTF Act, five under the UK Money Laundering Regulations. The evidence is there long after the job closes, and the window is set to the rule that binds you rather than to a default we picked.
What each regulation requires → - A complete audit trail
Each check records who was verified, what was run, and the decision and reasoning behind it. A defensible trail, ready for your MLRO or a regulator.
Worked example: what Tranche 2 asks for → - You decide, nothing is auto-submitted
StackGo runs the checks and presents the result. The decision to accept, escalate or act is always yours. Nothing is reported or submitted on your behalf automatically.
- Sensitive data redaction
Identifiers that serve no purpose in a verification record are redacted rather than stored. Tax file numbers are the clearest example, Australian TFNs and their UK equivalents alike: they stay in your practice software where they belong, and never land in the StackGo vault.
The privacy rules behind this → - Where your data is stored
Client data is held on Google Cloud Platform, in the EU (Dublin and Frankfurt) and Australia. International transfers are covered by Standard Contractual Clauses. Wording matches our privacy policy, which is the binding version.
Read the privacy policy → - Encryption in transit and at rest
The app server runs on SSL using TLS 1.2 with SHA-256. Stored data is protected with AES-128 under a separated configuration, with OAuth 2.0 for authorisation, behind a protection layer covering SQL injection (SQLi) and cross-site scripting (XSS).
- Access control
Access is restricted and protected by two-factor authentication, with a suspicious login blocker watching for unrecognised sign-in attempts. Only authorised people in your firm reach client records.
- Image lifecycle you control
Identity document images move to cold storage 45 days after a verification completes, and are permanently deleted at 12 months. The images are out of active reach long before they are gone for good.
- Retention policy in your hands
The auto-deletion parameters are yours to set, not ours to impose. Change the retention windows to match your firm’s policy, or archive data in a single click at any time.
The note goes in your system. The personal data does not.
Most compliance tools solve record-keeping by copying everything into everywhere. StackGo does the opposite, on purpose: no personal data enters your system of record by default. Your practice software receives the contemporaneous note, and the personal data stays in the vault, encrypted, behind its own access controls and permissions.
The result is a stronger privacy and security position than duplication could ever give you. Your firm keeps the audit trail your regulator expects, for as long as it expects, without spreading client PII into a practice management system that has different access rules and a different threat model. Every person with access to your practice software does not thereby get access to your clients' identity documents.
This is only possible because the check runs inside your workflow rather than beside it. A standalone tool has to hand everything back to you; an integrated one can decide what belongs where.
Independently reviewed
Compliance software should be able to show its own working. These are the standards StackGo meets and the reviews it has passed.
Xero certified app Passed Xero’s app review 
HubSpot certified app Passed HubSpot’s app review The technology layer, not the whole programme
StackGo is the software that runs the checks and keeps the record. Your AML/CTF programme, policies and staff training sit around it. We are happy to point you to partners who cover those, so your obligations are met end to end.
Security is how we meet the rule. The rule itself lives elsewhere.
Everything above describes how StackGo handles data. What that data has to prove, how long you must keep it, and who is allowed to see it are set by the regime you operate under — and those sit across three different kinds of obligation: anti-money laundering, identity verification, and privacy.
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.