Security
Controls you can inspect.
Our authorisations, registrations and certifications with the reference numbers you can check, and the controls the console demonstrates.
Authorisations and certifications
What we hold, and how to check it
Each item shows the issuer and a reference number. Where a public register exists, use the link to confirm it yourself.
Registered company in England and Wales
Registration- Issuer
- Companies House
- Reference
- 14876824
IronLedge Ltd, private limited company, incorporated 17 May 2023 (previously VELAFX LTD until 24 April 2026).
Check the public register
Demonstrated controls
What the console does
Maker and checker approvals
Payments above a threshold need a second person. Makers cannot approve their own payments.
Payment screening
Fraud Shield scores payments. Scores of 30 or more warn, 55 or more hold for call-back (24 hour window) and 90 or more block.
Role-based permissions
Roles carry permissions. Screens and actions the role cannot use are hidden or disabled.
Tenant isolation
Each organisation's data is separated from others in the prototype, with tests covering cross-tenant access.
Append-only audit log
Actor, action, entity, time and before and after values are recorded.
Time-limited support access
Staff support sessions are read-only, masked and countdown-limited, and appear in the client's audit log.
Secrets shown once
API key secrets are displayed once and the user must confirm they have stored them.
Evidence
Audit log screen
Documents
Ask for the evidence
Certificates, scope statements and the penetration test summary are available on request, under NDA where appropriate. Uptime, incident history and similar operational figures will be published only once they are backed by monitoring data we can cite.