Explainers
The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read
Formance
Regulatory evidence
Open Source Infrastructure for the Financial Internet
Formance against third-party requirements
For each regulation, how many of the requirements it places on your vendors Formance’s public evidence reaches. Open one for every item with its date and source.
- GDPR70%3 evidence found1 partial evidence1 no public evidence
- UK GDPR88%3 evidence found1 partial evidence
- DORA67%4 evidence found2 no public evidence
- NIS267%2 evidence found1 no public evidence
- HIPAA33%1 evidence found2 no public evidence
- PCI DSS25%1 partial evidence1 no public evidence
- EU AI Act0%3 no public evidence
- ISO 27001 Annex A88%3 evidence found1 partial evidence
- SOC 2 CC9.2100%2 evidence found
Documents on the trust centre
What the vendor lists, typed; public items can be read now, the rest are available on request.
8 documents listed on Formance’s trust centre
trust.formance.com- Data processing agreement
- Data Processing Agreementpublic · seen 21 Sep 2026
- Cyber insurance certificate
- CyberSecurity Insurance Certificateon request · seen 21 Sep 2026
- Formance Certificate of Insurance 24-25on request · seen 21 Sep 2026
- Penetration test report
- Formance Penetration Test 2025on request · seen 21 Sep 2026
- Formance Penetration Test 2025 - Certificateon request · seen 21 Sep 2026
- Formance Penetration Test Report 2024on request · seen 21 Sep 2026
- Formance Penetration Test Summary 2024on request · seen 21 Sep 2026
- SOC 2 report
- SOC2 Type IIon request · seen 21 Sep 2026
What the vendor says
Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.
Where data is hosted or processed
Where are your servers located?
“Formance's servers are located in AWS, with options for data residency in the EU.”
Regions named: EUas of 21 Sep 2026Source
Encryption
Does Formance encrypt data at rest?
“All customer data within the SaaS platform is encrypted both at rest and during transmission. All databases are encrypted at rest with AES-256 encryption - as part of the SOC 2 Type2 certification and ISO-27001 certification. Formance encrypts all transmission of customer data across all public networks transited using an industry standard encryption implementation - as part of the SOC 2 Type 2 certification and I...”
as of 21 Sep 2026Source
Penetration testing
Does Formance conduct penetration tests?
“Yes. Formance engages with one of the best penetration testing consulting firms in the industry at least annually. Our current preferred penetration testing partner is Rhymetec, leader in cloud security services, cybersecurity, compliance and data privacy solutions.”
as of 21 Sep 2026Source
Data retention and deletion
What is Formance's data retention and disposal policy regarding personal data?
“We do not store any personal data. Following the departure of a customer, we purge the backup of said customer's data.”
as of 21 Sep 2026Source
Reviewing a vendor against regulations
All articlesAnalysis
The state of public compliance evidence in 2026: what 3,000 vendors actually publish
CertReports Research · 18 Sep 2026 · 12 min read
This maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.