Last updated: June 2026
This Annex describes the main security, privacy, governance and operational continuity controls adopted by Sinky to protect information processed by its platform.
This document complements:
Sinky is a global AI-native decision infrastructure platform that helps organizations create, operate and evolve critical decisions related to credit, fraud, compliance, onboarding, risk and other corporate processes.
Information security is treated as a fundamental element of the platform's architecture, operation and continuous evolution.
Sinky maintains SOC 2 Type II certification based on:
The audit is performed by an independent auditor and evaluates the operational effectiveness of controls implemented by the organization during a continuous observation period.
Sinky operates considering principles present in:
The platform runs on Microsoft Azure-based infrastructure. The architecture was designed to offer:
Sinky maintains segregated environments for:
Specific controls limit access and movement between environments.
All communication with the platform uses TLS encryption. Insecure or obsolete protocols are discontinued as market standards evolve.
Data stored by the platform is protected by encryption mechanisms compatible with widely adopted industry standards. When applicable, we use AES-256 based encryption or equivalent controls provided by infrastructure providers.
Access to systems and information is granted only when necessary for executing each employee's responsibilities.
The platform supports role-based access control (RBAC). Permissions can be configured according to:
Permissions are periodically reviewed and removed when no longer necessary.
Sinky requires multi-factor authentication for access to critical corporate systems. MFA significantly reduces risks associated with credential compromise.
Credentials are managed by appropriate security mechanisms and should not be shared between users.
The platform records relevant security and operational events. Records may include:
Whenever technically applicable, the platform records:
These records enable traceability and auditing of critical decisions.
Sinky maintains monitoring mechanisms designed to identify:
Observability processes support diagnosis and operational response.
The organization adopts continuous practices for identifying, evaluating and addressing vulnerabilities. These activities may include:
Sinky maintains internal procedures for security incident management. Processes include:
When applicable, impacted clients may be notified as required by legal, regulatory or contractual requirements.
The platform's architecture was designed to reduce operational interruption risks. Sinky maintains processes for:
Backup procedures are executed to support operational recovery when applicable.
Data and records may be maintained for the period necessary for:
After applicable periods expire, data may be removed or anonymized according to internal policies.
AI features provided by Sinky are subject to the same security controls applicable to the rest of the platform. These controls include:
Additional information can be found in Sinky's Responsible AI Policy.
Sinky may use third-party providers to support platform operations. These providers are selected considering criteria related to:
Updated information can be found in Sinky's Subprocessor List.
Additional information related to security, privacy, governance and compliance may be made available through Sinky's Trust Center.
Questions related to information security may be sent to:
Email: security@besinky.com
or through official channels at: https://www.besinky.com