Security.

Identifiers are tokenized with a key dedicated to your institution; only an approved payout file export maps tokens back. Per-institution keys in AWS KMS, rotated yearly, destroyed at contract end. TLS 1.2 or higher in transit.

Offer definitions and disclosures; configuration, users and approvals; run metadata (times, row counts, error codes) and usage; totals over at least 10 customers (you can raise the minimum; smaller counts show as "fewer than 10"). Never: audience and suppression lists, customer-level results or record-level detail.

Landing and reject files stay in your data plane for 90 days (configurable), then are deleted. The token vault lives for the contract and is destroyed with your key at exit. Payout files and evidence are object-locked for the period your records schedule sets. No file may contain card numbers; ingest rejects any that do.

Because we operate the account, tokenization is an operational protection, not a cryptographic one. Institution-held keys are available on request. Each institution's records in the shared control plane are separated by database row-level security, tested on every build.

Your identity provider over SAML or OIDC, with MFA, step-up authentication for every approval and SCIM provisioning.

Data, backups, logs with record-level identifiers, and model calls stay in the country your contract names. The control plane runs one stack per country. US institutions: US regions named in your order form. Canada: ca-central-1, with ca-west-1 for standby.

Staff sign in only from a managed device in their tagged country, and your contract lists the regions allowed to support you. Any exception is a named, recorded session you approve in writing.

Multi-zone in one region, with backups in a second in-country region. Ledger, approvals, fulfillment and evidence records: recovery point 15 minutes; recovery time in contracts 24 hours. Faster objectives are offered only once a timed drill has met them. Immutable backups are kept 35 days in a separate locked account, with quarterly automated restore tests. After any restore, payout files stay paused until the ledger is reconciled, so no payout is sent twice or skipped.

Standard: models hosted by our cloud provider (Amazon Bedrock) in our accounts, on endpoints verified to process in your country, under no-training terms recorded on your AI annex. It never receives identifiable customer or member data, and it is off where no in-country endpoint exists.

Private: the provider's model service called from your institution's own cloud account, under your own agreement. Your own model endpoint is available on request.

Explaining a flagged payout is a customer-data AI feature. It uses pseudonymized evidence, runs only on a Private or your own endpoint, is labeled as AI-written and is shown after the signals, never in place of them. No model runs in the reward-integrity checks.

Source code and continuity escrow with a third-party agent is available on request; it is released on insolvency, cessation of business or 30 days without contracted support, with a perpetual license to run your own deployment.

At exit: a verified export in open formats (Parquet, JSON, PDF), the token map and keys needed to verify evidence, and up to 90 days of transition help. Live data and keys are deleted within 30 days, with written confirmation. If Devanka is acquired, payouts are unaffected: you stay payer of record, and these terms are part of your contract.

The accounts, transactions and enrollments files your core already produces, delimited or fixed-width. Delivery by SFTP with key authentication (a run starts only when a completion marker lands), a storage bucket you own, an upload from your scheduler, or a manual upload. An alert fires if expected files haven't arrived. Your core imports one posting file a day in its own format, set up at onboarding and kept as a template.

Next to a core promo module, a digital-banking offer engine or internal SQL and spreadsheets, Ankasum adds one approved definition that drives the readback, the disclosure and the payout file, an independent recompute of every payout, and signed evidence.

Referral programs, rate specials priced in the core, card-spend rewards, recurring rewards-checking cycles, non-cash rewards and offers that grant or change credit terms. Creative made elsewhere (ads, branch or call-center scripts) stays in your own review.

The trial fee is fixed and stated in the written proposal before any data is shared, invoiced at the start and credited against year one when you sign. Implementation is quoted with the subscription. Data export and transition help at exit are included. Usage limits are fair-use guards that warn first and never stop a live offer. For a proposal, email hello@devankahq.com with your asset size and account count.

Against each, Ankasum produces a required-field checklist per charter, a disclosure built from your clause library, the readback, signed evidence and an examiner export. The disclosure check warns on wording that can be read two ways.

Amazon Web Services: hosting of the control plane (one stack per country) and each institution's data plane, in US regions named in your order form or ca-central-1 and ca-west-1.

Amazon Bedrock (AWS): AI model calls, in the same in-country regions. Authoring AI receives offer text, terms and disclosures only. Every model provider signs no-training terms. The full list is in the due-diligence pack.

We do not state audit or certification status on this website. The due-diligence pack lists the assurance evidence available, with dates, together with the security questionnaire and insurance details. Audit rights are in the security addendum.

• Incident notice within 24 hours of determining your data or service was affected; written report within 5 business days.
• 30 days' notice of subprocessor changes.
• Deletion within 30 days of contract end, with written confirmation.
• Model prompt and response text kept 90 days by default (you set the period).