Live status
SOC 2 Type II
In preparation · targeted Q4 2026
We are actively preparing for our SOC 2 Type II audit, on track for the next 4–6 months.
Private banks & trust companies
Enterprise-grade. Fiduciary-aware.
The institutions that hold the deepest relationships carry the heaviest duty to protect them. GuardKin gives a private bank or trust company a premium estate-readiness offering with a boundary your infosec and fiduciary teams can actually verify — not take on faith.
What this institution needs
Built for the duty you already carry.
A boundary your infosec team can verify
Sensitive content is sealed with keys the server never holds. "What can your platform see?" has a structural, audit-able answer — not a policy promise. Your security review gets a data-flow it can actually check.
Fiduciary-aware by design
Advisor visibility is consent-scoped to planning metadata; content stays with the client. The institution holds the relationship without holding the client’s secrets — exactly the line a fiduciary duty asks you to keep.
Continuity through the transfer
The moment your platform most often loses the next generation is the wealth transfer. GuardKin is the premium readiness offering that earns the heir’s trust before the assets move, and a clean executor handoff after.
Procurement-ready evidence
A Trust Center, subprocessor register, security architecture write-up, and honest compliance status — assembled the way an enterprise InfoSec questionnaire expects, so a review moves in days, not quarters.
0
Content keys held by GuardKin servers
9
Public security commitments in the ledger
100%
Sensitive content the server cannot decrypt
Structural figures only. We publish no invented institutional logos, AUM, or cohort numbers — pilot results will be labeled as such, with consent, when they exist.
For your due-diligence team
The evidence, where you expect to find it.
Everything an enterprise InfoSec review asks for is public and structured — so the assessment moves quickly and on the record.
Controls
Data residency & retention
Documented residency, retention, deletion, and export posture — the table your due-diligence team will ask for, published on the security page.
Read the detailControls
Incident response & SLA
IR, BCP/DR, and SLA commitments laid out for an enterprise relationship, with disclosure handled through a published security.txt.
Read the detailControls
Subprocessor transparency
Every vendor in the data path is named in a public register, so your vendor-risk process has a real list to assess — not a black box.
Read the detailSecurity signature
Read the trust centerA boundary you can verify, not just be told about.
By architecture
Zero-knowledge
Content keys never reach us
Sensitive content is encrypted client-side. Our servers store only ciphertext.
By architecture
Cryptography review
Independent review · scheduled
Cryptographic design under independent review — scope on record, findings on completion.
- AES-256-GCM
- X25519
- Argon2id
- Ed25519 audit chain
- TLS 1.3
- HSTS preload
- CSP nonce
- No third-party trackers
Bring it to your institution
Start with the review your team would run anyway. We’ll meet it.
We design pilots around an institution’s real procurement and fiduciary requirements. Tell us what your review demands, and we’ll show you exactly how the architecture answers it.