Legal

Security

What a third-party risk team needs, in the order they ask for it — stated only as far as it has been verified.

Scroll

Effective 2026-09-02 · Last updated 2026-09-02

Attestations and audits

Sweet maintains a SOC 2 Type II attestation. The report is available to prospective customers under NDA.

Report type: SOC 2 Type II
Criteria in scope: Security

Why this page never says “SOC 2 certified”

SOC 2 is an attestation engagement. An independent CPA firm examines a service organisation's controls and issues a report containing an opinion. There is no certificate, no certifying body and no pass mark, so no company is “SOC 2 certified”, and nothing is “SOC 2 compliant”, because SOC 2 is not a regime with requirements to comply with. Type II means the report covers how controls operated over a period.

The correct forms are SOC 2 Type II and SOC 2 Type II attestation, and the canonical wording lives in one internal record so every surface on this site uses the same words.

Data isolation

Each institution's loan, borrower, and document data is held in a dedicated database and a dedicated document store for that institution — it is not pooled with other customers' records. Platform-level services, such as the sign-in directory for institution users, are shared infrastructure operated under the same access controls.

Infrastructure and data handling

Hosting: Amazon Web Services, us-east-1 (N. Virginia, United States) — the sole cloud provider for the production platform. The managed database (CockroachDB Cloud) also runs on AWS us-east-1.
Data residency: Customer data is stored and processed in the United States (AWS us-east-1). Notification delivery (email via SendGrid, SMS via Twilio) is likewise processed by US providers.
Encryption in transit: TLS 1.2 minimum on all public endpoints — TLS 1.1 and below are refused (verified against the production API gateway, 2026-09-01).
Encryption at rest: AES-256 encryption at rest across the database and document storage, with keys managed in AWS KMS. Tenant personally identifiable information is additionally encrypted under a per-institution customer master key.
Access control: Customer sign-in supports single sign-on via SAML/OIDC identity providers (for example Okta and Google). Sweet staff reach production through AWS IAM Identity Center with role-scoped, short-lived credentials.
Security incidents: If a confirmed security incident affects an institution's data, Sweet notifies that institution without undue delay, as its agreement and applicable law require, and supports the institution in meeting its own notification obligations to borrowers and regulators.

Numbers that belong in contracts — retention windows, notification hour-counts, testing cadence — are set in each institution's agreement, not published here at the tightest figure ever negotiated.

AI governance

The platform is built so that credit decisions are made by people at the lending institution. Sweet's AI extracts, checks completeness, validates and flags — it does not approve, decline, or price a loan.

What the AI does

Reads submitted documents, including handwritten ones, and extracts the data on them.
Checks a file for completeness and validity against the lender's own requirements.
Raises flags for a human to look at, with the underlying document one click away.

What it does not do

It does not approve or decline an application.
It does not set pricing or eligibility.
It does not act on a borrower's account without a person authorising it.

Sub-processors

The providers that help Sweet run the platform and this website, current as of 2026-09-02. Each acts under contract; those handling platform data act on Sweet's instructions, and our website CDN (Cloudflare) additionally keeps edge logs under its own policies (see the privacy page).

Sweet's sub-processors and what each one does
Provider	Purpose
Amazon Web Services	Cloud hosting for the production platform (us-east-1, United States).
Cockroach Labs	Managed database service, itself running on AWS us-east-1.
Cloudflare	Delivery, DNS, and security for this website.
Novu	Notification orchestration for platform email and SMS.
Twilio	SMS delivery for platform notifications.
SendGrid	Email delivery for platform notifications.
Sentry	Application error monitoring, used to keep the service reliable.
Atlassian Statuspage	Service-status notifications: if you subscribe to updates on our status page, your email address or the webhook destination you provide is processed there to deliver them.
Nutrient	Document viewing and processing components in the platform.
Google (Google Analytics)	Usage analytics for this website: page views, referrer and device information, processed under Google's terms. Switched off when your browser sends a Global Privacy Control or Do Not Track signal.

Separately, integrations an institution chooses to enable — financial data connections, credit bureaus, electronic signature and vaulting providers, CRM systems — receive data because that institution directed it, under that institution's own agreements with those providers. Institutions are notified of sub-processor changes as their agreements provide.

Data retention

Platform data is retained for the duration of the institution's agreement and as the institution instructs; lending records carry their own regulatory retention periods, which the institution controls. When an agreement ends, data is returned or deleted in accordance with the contract, and residual copies in backups are handled in accordance with that contract. Website enquiries are kept only as long as the conversation and Sweet's ordinary business records require.

The figures on this site

The performance figures on this site are marketing figures: they describe what has happened, and they are not a forecast. Each is published with an as-of date, and the definition and source behind any figure are available on request. Past platform volume or a reported efficiency gain at one institution does not predict a result at yours.

This website

Separate from the platform: these are properties of the code that serves you this page, and each one names the file it can be checked in.

This site's own code sets no cookies. The one third-party script it loads, Google Analytics, sets first-party analytics cookies (_ga, _ga_*) — unless your browser sends a Global Privacy Control or Do Not Track signal, in which case it is switched off and sets none.

No document.cookie write exists anywhere in src/. The Google Analytics tag in src/layouts/Base.astro is the only script that sets a cookie; when navigator.globalPrivacyControl or doNotTrack is set, the page sets Google's documented opt-out (window['ga-disable-<ID>']) before the library loads, and it then sets no cookie and sends no hit. The first-party measurement layer in the same file is explicitly cookieless. Cloudflare, which delivers the site, may set security cookies of its own (see the privacy page).
Pages on this site load one analytics script — Google Analytics 4, from googletagmanager.com — and no advertising or cross-site tracking pixel; every font, image, style and other script comes from this domain. The other exceptions are /status/, which reads our status feed from Atlassian Statuspage and delivers status subscriptions to Statuspage, and videos you deliberately click to play, which load from YouTube (youtube-nocookie.com).

The Google Analytics tag is installed once, in src/layouts/Base.astro: production builds only, page views bound to astro:page-load so client-side navigations are counted, and disabled via Google's ga-disable opt-out under GPC/DNT. Fonts are self-hosted in public/fonts/ (the Google Fonts import was removed); there is no pixel; the only embeds are click-to-load YouTube players (youtube-nocookie.com) that load nothing until played. The other thing that can leave this domain is a form you deliberately submit. See below.
Beyond Google Analytics, no analytics data is collected or transmitted: the site's own first-party event layer sends nothing unless and until Sweet configures an endpoint of its own.

The event layer in src/layouts/Base.astro sends nothing when PUBLIC_ANALYTICS_ENDPOINT is unset, and additionally requires an explicit consent signal before it sends anything even when it is set.
The site is static. Pages are pre-rendered files with no server-side session and no user account.

Astro static build, astro.config.mjs.

Form backend: The enquiry form posts to Web3Forms (https://api.web3forms.com/submit), and it is live in this build. Beyond fonts, images, styles and its own scripts — all served from this domain — the third parties this website itself talks to are Google Analytics (usage measurement, switched off when your browser sends a Global Privacy Control or Do Not Track signal), Atlassian Statuspage (the status feed and subscriptions on /status/), YouTube when you choose to play a video — and Web3Forms if the enquiry form is enabled.

Full detail of what this site does and does not collect is on the privacy page.

Reporting a vulnerability

If you believe you have found a security issue in this website or in the Sweet platform, we want to hear about it before anyone else does. Email security@sweettech.ai — a monitored alias — with enough detail to reproduce what you saw, and give us the chance to fix it before any public disclosure.

The full control set, the SOC 2 Type II report and completed questionnaires are available to prospective customers under NDA. Ask the person you are already speaking to, or email security@sweettech.ai.

Send us your vendor questionnaire.

We would rather answer it early than late. Ask for the security pack and the SOC 2 Type II report under NDA.

Talk to the team Read the FAQ