Compliance overview
SorenPay is not a bank. Your US dollar account is held at our partner bank, cards are issued through our card issuing partner, and identity checks for personal accounts run through an identity-verification partner.
Private beta: test money only
Every workspace runs in sandbox today. Nothing described here moves real money yet, and the checks marked "not built yet" below must be in place before live accounts open.
Who checks what
| Check | Who does it | Status |
|---|---|---|
| Business verification (KYB) and the business's owners | Our banking partner, from the details you enter at onboarding | Built. In sandbox the partner's test environment decides, or the form is only stored |
| People who get cards | Our card issuing partner | Built for sandbox |
| Personal accounts (photo ID and selfie) | Our identity-verification partner | Built. In sandbox you pick the result yourself |
| Sanctions screening at onboarding | Our banking partner, as part of business verification | Partner-side only |
| Sanctions screening run by SorenPay itself | SorenPay: every new recipient, workspace, personal account and cardholder, and everyone again every night (details) | Built. In sandbox it uses a small test list, not the official one |
| Crypto Travel Rule (transfers of $3,000 or more) | SorenPay | Not built yet, so USDC withdrawals of $3,000 or more are refused |
What SorenPay does itself
- Ledger. Double-entry: every movement has matching debits and credits.
- Card spending rules. Limits, merchant categories and merchant names are checked on our servers on every card payment.
- Webhook checks. Webhooks from our partners are checked (a signature or a shared secret) before we act on them; anything that fails is rejected. Webhooks we send are signed (see Notifications).
- Idempotency. Endpoints that accept an
Idempotency-Keyreplay the first response for 24 hours. - Workspace isolation. Every query runs for one workspace. Database-level isolation switches on when we move to our new database; until then it's enforced in the app.
- Audit trail. Payouts, ledger corrections and transfers we pick up from the bank are written to a hash-chained audit table.
Not built yet
- Travel Rule information exchange for crypto transfers.
- Transaction monitoring.
- KYB and KYC decisions in the audit trail.
Subpages
- Identity verification: who verifies whom, what we store, and for how long