Built to meet depositary and regulator expectations.
Depositaries operate under some of the strictest security and operational resilience requirements in regulated finance. Depowise is certified, audited, and architected specifically for institutions where regulatory scrutiny is constant and data sensitivity is critical.
ISO 27001
Information security management certified to the global standard required by institutional buyers and regulators.
DORA
Operational resilience practices aligned with the EU Digital Operational Resilience Act, the binding framework for financial services from January 2025.
GDPR
European data protection obligations embedded in how customer data is handled, across every deployment model.
Three layers of operational security.
Identity and access
SSO via SAML 2.0 and OpenID Connect through your own Microsoft Entra ID. MFA enforcement, conditional access, and role-based access control down to fund and workflow level. No local user accounts stored by Depowise.
Data protection
AES-256 encryption at rest via Azure platform-native encryption. TLS 1.2+ in transit. Single-tenant architecture with dedicated databases, storage, and compute per customer. Optional Bring Your Own Key via Azure Key Vault.
Operational controls
24/7 monitoring through Azure Monitor and Microsoft Defender for Cloud. Immutable audit logs. Annual penetration testing. Disaster recovery with sub-4-hour RTO on premium deployments. SIEM integration with Microsoft Sentinel.
Keep the data in.
Keep the intelligence yours.
Depositary data belongs to the funds you serve, and their contracts increasingly say so in detail. That reality, more than the pace of model releases, is what decides how technology can be used in a regulated depositary operation.
No training on your data
Your data is never used to train shared models and never used for our product development. Processing happens for your operation, on your data, and produces output for you alone.
Bring your own model
Institutions that have built models internally can connect their own and run it inside Depowise, under their own rules. Where internal policy dictates which model may touch the data, that stays your decision.
Contractual controls, honoured line by line
The funds you serve increasingly write explicit data terms into their contracts: no sharing, no model training, no product development on their data. Those terms can be met and evidenced, not negotiated around.
Your jurisdiction, one boundary
Single-tenant deployment in the region you require, with AI processing inside the same boundary as the rest of your depositary data rather than routed out to a shared service.
Both model options, Depowise AI and your own, sit behind the same controls. See how AI works in Depowise.
Dedicated environments, not shared tenancy.
The banking, fund management, and custody industries have regulatory expectations that generic multi-tenant SaaS cannot meet. Every Depowise customer operates in a dedicated Azure subscription, with isolation enforced architecturally rather than through configuration.
- Compute isolation: dedicated App Services, containers, storage accounts, and SQL instances per customer.
- Storage isolation: dedicated Azure SQL databases and Storage Accounts. Backups are customer-specific and cannot be cross-restored.
- Management isolation: Azure RBAC scoped to the dedicated subscription. Logs and monitoring cannot be cross-referenced between tenants.
- Identity isolation: authentication routed exclusively through the customer's own Entra ID.
Dedicated Azure subscription · per customer
Compute
App Services · containers
Storage
Azure SQL · Storage Accounts
Identity
Customer Entra ID
Management
Azure RBAC scoped
No shared environments
Backups, logs, and monitoring cannot be cross-referenced between tenants.
Encryption at every stage, keys under your control.
Data encryption is non-negotiable for financial institutions. Depowise applies full encryption at every stage of the data lifecycle, with optional customer-held keys for institutions that require cryptographic control to remain internal.
- AES-256 encryption for Azure SQL and Storage at rest.
- TLS 1.2+ for all web traffic. IPsec/IKE VPN tunnels supported for customer-to-cloud connectivity.
- Azure Private Endpoints for internal service communication.
- Optional Bring Your Own Key (BYOK) via Azure Key Vault for regulated environments.
Encryption layers
- AES-256
At rest
Azure SQL · Storage
- TLS 1.2+
In transit
Public + VPN tunnels
- Private Endpoints
Internal
Service-to-service
- BYOK
Key control
Optional · Azure Key Vault
Security integrated into development, not added afterwards.
Depowise operates a formal Secure Software Development Life Cycle aligned with NIST SP 800-218 and ISO/IEC 27001. Security controls are automated in the CI/CD pipeline, with mandatory peer review for every change and stricter requirements for anything with material security impact.
- Secure coding standards based on OWASP ASVS enforced across .NET and TypeScript.
- Static Application Security Testing (SAST) via CodeQL and Software Composition Analysis (SCA) for dependencies.
- Automated secrets scanning to prevent plaintext secrets in repositories.
- Annual penetration testing, plus additional testing after any change with significant security impact.
CI/CD security gates
- 01
Code
OWASP ASVS
- 02
Review
Mandatory peer review
- 03
Scan
SAST · SCA · secrets
- 04
Verify
Annual pen testing
- 05
Deploy
Automated CI/CD
Three hosting models, one security posture.
Procurement and IT teams across the depositary industry operate under different constraints. Some can use cloud-managed services; others require customer-controlled environments; a small number cannot use cloud at all. Depowise supports all three, with the same security principles applied consistently.
- Depowise SaaS: fully managed on Microsoft Azure by Depowise and Proximus. ISO 27001 certified operational chain across application, platform, and managed network layers.
- Customer Private Cloud: deployed in the customer's own Azure subscription. Customer retains control of the environment, networking, and security controls.
- On-premises: fully supported deployment on Windows Server with Microsoft SQL Server for organisations that cannot use cloud services.
Hosting models
- Depowise + Proximus
Depowise SaaS
Fully managed · Azure
- Customer-controlled
Customer Private Cloud
Customer Azure subscription
- Customer-managed
On-premises
Windows Server · MSSQL
Every action logged, every event traceable.
Regulators require depositaries to produce evidence. Depowise captures every user action, workflow step, file-level event, and access control attempt in an immutable audit log. The evidence base for regulatory review is created as a by-product of normal operations, not as a separate reporting exercise.
- Application-level audit log covering all user actions, workflow steps, and file processing events.
- Access control failure logging: denied access attempts captured with user and context detail.
- Integration monitoring: file receipt, processing status, and validation outcomes visible through dedicated dashboards.
- Azure Monitor, Log Analytics, and Microsoft Defender for Cloud for real-time platform observability.
Immutable audit log · today
- 14:08OK
Access granted · workflow WF-482
Artur Reiter
- 14:03Logged
Document accessed · capital_call.pdf
Sara Martinez
- 13:58Denied
Access denied · admin console
Unknown
- 13:32Logged
File received · MT940 batch
System
- 09:00OK
Login · MFA verified
Artur Reiter
Operational resilience, built in and tested.
Depositary oversight cannot stop. Depowise is architected for high availability through Azure Availability Zones, with optional mirrored disaster recovery across regions for institutions with strict business continuity requirements under DORA and equivalent frameworks.
- Zone-redundant architecture in the primary region, typically West Europe, with minimal disruption from zone-level failures.
- Optional secondary Azure region for disaster recovery, with platform-level RTO of less than 4 hours for a full regional outage on premium deployments.
- Declarative deployment via IaC for automated, repeatable recovery actions.
- Geo-redundant storage and zone-redundant SQL Elastic Pools on premium tiers.
Region topology
Primary · West Europe
Zone-redundant SQL · App Services
Secondary · DR optional
Geo-redundant storage · mirrored
RTO < 4 hours · premium deployments
DORA-alignedReporting a vulnerability.
If you believe you have discovered a security vulnerability affecting Depowise, please report it to our security team. We commit to acknowledging reports within two business days and working directly with the reporter through to resolution.
See your depositary operations on Depowise.
Request a personalised walkthrough of the platform.