Security and compliance, stated plainly

The people on our platform are often in vulnerable circumstances. Here is exactly how we look after their data, and where we are still working.

Last reviewed 24 October 2026

Request the security pack

Regulatory status

Elifinty Limited is a technology provider and is not authorised by the FCA. Regulated debt advice is given by the organisations that use EliConnect. Open banking and credit reference data are provided through AperiData Limited, which is FCA-authorised as both an account information service provider and a credit reference agency. EliConnect is designed to help our clients meet the Consumer Duty (FG22/5), CONC 8, the MaPS Standards and the FCA's durable medium and complaints reporting rules.

Data protection

We are registered with the ICO (ZA745513). For EliConnect we act as processor and our clients are controllers, under a data processing agreement. People's data is kept in the UK, never sold, and never used to train AI models. Our privacy notices for the website, the Eli app and EliConnect clients are available on request until they are published here.

Security controls

Hosted on AWS in the UK. AES-256 encryption at rest with separate keys per data store, and TLS 1.2 or higher in transit. Tenant isolation on every data access path. Role-based access, reviewed quarterly. Independent external penetration testing at least once a year and after material changes.

Certification

Our information security management system is aligned to ISO/IEC 27001 and ISO/IEC 27017. We are not yet certified, and certification is on our roadmap.

Resilience

We maintain a business continuity and disaster recovery plan and a business wind-down plan, so clients can get their data back in an orderly way whatever happens to us.

AI safeguards

Eli AI assists advisers and never makes advice decisions. Sensitive information is kept out of AI prompts, AI-assisted steps are logged, and sentiment or distress signals are flags for a person to review, not automated vulnerability assessments.

Due diligence

Request the security pack

Information security policy, data protection policy, business continuity and wind-down plans, complaints policy, the master subscription agreement, and a penetration test summary under NDA.

Is Elifinty FCA-authorised?

No. Elifinty is a technology provider. The organisations that use EliConnect give regulated advice under their own permissions. Open banking and credit data are provided through AperiData, which is authorised by the FCA as an account information service provider and a credit reference agency.

Is Elifinty ISO 27001 certified?

Not yet. Our information security management system is aligned to ISO/IEC 27001 and certification is on our roadmap. We will tell clients when it is achieved.

Where is data hosted?

On AWS in the UK, with each client's data separated by tenant on every access path.

Who is the data controller?

For EliConnect, your organisation is the controller of its client records and Elifinty is the processor. For the Eli app, Elifinty is the controller of the data people give us directly.