A cloud-native, multi-tenant SaaS platform.
RegNovaIQ runs on public cloud infrastructure and is delivered to customers over the internet as a hosted service. There is no on-premise installation.
Architecture
Containerised services
The platform is built as independently deployable services running in managed Kubernetes. Capacity scales with screening volume rather than being provisioned per customer, which is what makes a single deployment able to serve institutions of very different sizes.
Managed relational database
Customer records are held in a managed PostgreSQL service operated by the cloud provider, with automated backup and point-in-time recovery.
Event streaming
Transactions and screening requests are processed through a Kafka streaming layer running inside the platform's own cluster. This is what allows sanctions and fraud screening to run in real time as events arrive, rather than in an overnight batch.
Graph store for entity networks
Relationships between entities — ownership chains, mule networks, shared identifiers — are held in a Neo4j graph database running inside the platform's cluster, so network questions are answered as graph traversals rather than as repeated relational joins.
Machine-learning detection
Detection models score entities and transactions in line with processing. Every score is emitted together with the features and the reasons behind it, so an analyst — or a regulator — can see why a decision was reached and not merely what it was.
Multi-tenancy
Every record is bound to a tenant, and tenant isolation is enforced in the data layer rather than only in application code. The isolation invariant is re-verified on every deployment.
Security posture
Encryption in transit
All traffic to the platform, and between its internal services, is encrypted using TLS.
Encryption at rest
Databases, object storage and backups are encrypted at rest.
Data residency
Customer data can be pinned to a specific cloud region, so that it does not leave a chosen jurisdiction.
Access control and audit
Role-based access control governs every action, and privileged operations are written to an append-only audit trail.
Our SOC 2 Type II programme is underway. We do not currently hold SOC 2, ISO 27001 or any other third-party security certification, and we do not claim to.
Talk to us about deployment
For architecture detail, data-residency requirements or a security review, get in touch.