Security

Data Security and Compliance Posture

TwoWay processes regulated financial communication data. This page describes our technical controls, data residency commitments, and compliance posture in plain terms.

Technical Overview

Built for Regulated Environments

All TwoWay infrastructure runs in EU data centres. Data does not leave EU jurisdiction at any stage of ingestion, processing, or storage. Connections use TLS 1.3 in transit. Data at rest is encrypted with AES-256 with per-tenant key management. No client data is used for model training or shared between tenant environments.

Source message metadata is retained to satisfy MiFID II Article 16 communication review requirements. Retention periods are configurable by tier. Structured output records carry full parse provenance for audit trail purposes.

GDPR and Data Protection

Processing Financial Data Under EU Law

Broker communication data is personal data under GDPR. TwoWay acts as a data processor. All processing occurs under a formal Article 28 DPA.

Article 28 Data Processing Agreement

Floor and Enterprise clients sign a GDPR-compliant DPA covering lawful basis, purpose limitation, data subject rights, and sub-processor controls. Template DPA available on request before contract signature.

EU Data Residency

All data processing, storage, and backup occurs within EU member state data centres. No standard contractual clauses required. No transfers to third countries. Fully compatible with GDPR Chapter V restrictions.

MiFID II Article 16 Compatibility

Structured records and retained source metadata support MiFID II communication surveillance and review obligations. Records include source platform, timestamp, and counterparty context as required for regulatory review periods.

Access Controls

Least-Privilege Access by Default

Access to structured records and audit logs is controlled at the role level. No shared credentials. All access events are logged.

  • Role-Based Access Control

    Desk-level and user-level roles define which records each user can read or export. Admin roles manage API token issuance. No single shared account for data access.

  • Full Audit Logging

    All access to structured records, configuration changes, and API calls are recorded in an immutable audit log. Logs are available for export and are included in the seven-year retention on Floor and Enterprise tiers.

  • API Token Management

    API tokens are scoped per integration and can be rotated or revoked independently. Tokens do not carry cross-tenant access. Expiry policies are configurable per token.

  • Encryption Key Isolation

    Encryption keys are managed per-tenant. No shared key material between client environments. Key rotation is performed on a scheduled basis without service interruption.

Responsible Disclosure

Reporting Security Issues

We take all security reports seriously. If you identify a potential vulnerability in TwoWay infrastructure or APIs, contact us directly at [email protected] with details of the issue. We acknowledge all reports within two business days.

We ask that you do not publish vulnerability details publicly until we have had reasonable opportunity to investigate and remediate. We will keep you informed throughout the process and credit researchers who assist us responsibly.

Need the Data Processing Agreement template?

We can share our standard DPA template ahead of any formal pilot agreement. Contact us to request it.

Request a Pilot Request DPA Template