Where SQACE runs, and how your data stays protected.
SQACE is an independent verification authority. For that to hold up, it has to be clear where your data is processed, who can reach it and what stays traceable. This page answers the questions a security review and an architecture review ask, soberly and concretely.
One point of framing up front: SQACE is not a compliance tool. SQACE tests whether data processing delivers the correct result. In doing so it produces evidence you can use toward audit and regulators. Your organization meets the regulatory framework itself; SQACE supplies reproducible evidence for it.
The data flow at a glance.
- Source systems Databases and files Connected via JDBC (Oracle, MS SQL Server, PostgreSQL) and from CSV, JSON, XML and fixed-width files. Read-only access (Enterprise: separate Production Server)
- SQACE, protected data space Own storage, separated environment Rule sets, runs and results in its own storage. Enterprise: the Production Server reads production data read-only, physically separated. Verification environment, own storage
- Results Dashboards and reports Classified deviations with drill-down to field and rule level, available in the interface and via REST. Results space, no write access to the source
Source systems, the data space and the results all stay inside this boundary. SQACE sends no telemetry and no usage data out.
What the data space has built in.
The protected data space is more than a storage location. It brings the controls a security review asks about. Each capability answers a concrete question.
Who may do what
Permission concept
Roles and rights down to the object level. In the Enterprise edition through Mission Spaces inside a workspace, tied into your existing identity management.
Who did what, and when
Tamper-evident audit trail
Runs, rule changes and approvals are logged. Solutions promoted to production are read-only. It stays traceable who tested what, and on what basis.
Which state applied
Versioning
Rule sets, test building blocks and runs are versioned. A run can be reproduced with exactly the rule state that applied at the time it executed.
How long it is kept
Automatic deletion and retention
Retention periods are configurable, deletion is automated. Data and results are kept only as long as you define, then removed.
How people sign in
SSO and Active Directory
Sign-in via single sign-on and Active Directory. SQACE fits into your existing access and permission landscape rather than standing up a second one beside it.
Where the data sits
A dedicated, separated data space
SQACE works in its own storage. In the Enterprise edition the environments are physically separated, and the Production Server reads production data read-only (privacy by design).
On premises or EU cloud. Made in Europe.
You decide where SQACE runs. Either way, processing stays inside the boundary the data-flow diagram shows.
Development and an operating option in Europe On premises
SQACE runs in your data center. Your data stays fully under your control, and you run it.
EU cloud of your choice
Operated in an EU region. Source systems, the data space and the results stay inside the EU boundary the diagram shows. We fix the specific region and hosting model in the security review.
Roles under GDPR
As a rule you remain the controller of your data. Where SQACE processes on your behalf, that processing is governed by a data processing agreement under Article 28 GDPR. The exact split of roles depends on the operating model and is recorded in the review.
Honest about the tier
Some guarantees are Enterprise-tier: the read-only Production Server on production data and the physical separation of environments. Which tier covers these and other properties we set out transparently, so you assume nothing your license does not include.
Operation with no quiet data outflow.
No telemetry. SQACE sends no usage or product data to third parties. There is no quiet data flow for a review to uncover later.
No artificial limits. Users, storage and CPU are not capped by the license. The architecture scales with your load, not with the number of heads.
Made in Europe, Frankfurt am Main. SQACE is a product of FINARIS GmbH, with over 20 years of banking-domain depth (formerly RapidRep). Development and accountability sit in Europe.
Which capability serves which requirement point.
Regulation is often the reason correct testing gets funded. SQACE supplies the defensible evidence you use to back individual requirement points. This is evidence SQACE produces, not a compliance product: your organization meets the framework. Which capability serves which point, and which artifact it yields, you can read here.
Operational resilience
DORA
Calls for demonstrably resilient ICT processes. Reproducible runs show that a processing step was tested and which result it produced. Artifact: a versioned run plus the audit trail.
Sound business organization
MaRisk
Expects traceable data processes and controls. A tamper-evident log makes control activities auditable and presentable. Artifact: a classified deviation plus the audit trail.
Risk data aggregation
BCBS 239
Requires accuracy and traceability of aggregated risk data. The rule-based expected/actual comparison checks the result of the aggregation, not just whether the data looks plausible. Artifact: a classified deviation with drill-down to field and rule level.
Validated processing
GxP
Calls for validated, reproducible processing with complete documentation. Artifact: a versioned run against a versioned rule state plus the audit trail.
The security-review pack: what you can put on the table.
A review needs documents, not promises. We provide these on request and under NDA, so your review team can assess SQACE without detours.
What we deliver
- On request, under NDA
Data-flow diagram
Where data enters and leaves, what crosses the boundary and what does not. The basis for assessing the attack surface.
- On request, under NDA
Control and measures list
The technical and organizational measures at a glance, as a list you can check against your own audit catalogue.
- On request, under NDA
Data processing agreement (Art. 28 GDPR)
For the case where SQACE processes on your behalf. We discuss the template and the specifics with you.
- On request, under NDA
Sub-processor list
For the EU-cloud option: which sub-processors are involved. With on-premises in your data center this point largely does not apply.
- On request, under NDA
Architecture and deployment documentation
Structure, environments and separation, with operating and deployment details for the architecture review.
- On request, under NDA
Penetration-test summary
A summary of the results from security testing. We state the current status and scope in the review.
What the review also covers
We address these topics in the security review in detail. We provide the evidence on request rather than asserting it here as a blanket claim.
- Encryption in transit and at rest: the methods in use and where they apply.
- Secure SDLC and vulnerability management: how changes are made, reviewed and how vulnerabilities are handled.
- Incident response: how security-relevant incidents are handled.
Certifications, honestly
We do not claim certificates we cannot back up.
We tell you the current certification status in the security review. What we deliver are the documents above: the diagram, the control list, the data processing agreement, the sub-processor list, the architecture and deployment documentation, and the penetration-test summary. We would rather give you exactly that than imply a seal we cannot evidence here.
Honest about integration.
Data sovereignty also depends on what SQACE is connected to in the first place. Today SQACE reads from JDBC databases (Oracle, MS SQL Server, PostgreSQL and other JDBC-compatible ones) and from files (CSV, JSON, XML, fixed width), integrates with Jira and Xray, and is driven via REST for CI/CD.
Native connectors to, say, dbt, Snowflake or Airflow do not exist at present. We would rather state the current state precisely than suggest coverage that is not there. The full list and the operational details are on the integrations page.
What audit and architecture tend to ask first.
No. SQACE runs on premises or in an EU cloud of your choice. Source systems, the protected data space and the results all stay inside that boundary. SQACE sends no telemetry out.
Not for verification. In the Enterprise edition the Production Server reads production data read-only and is physically separated from the other environments. Write actions are possible, but run deliberately against separate targets, never against the source under test.
No. SQACE tests whether data processing delivers the correct result. In doing so it produces evidence (an audit trail, versioning, classified deviations) that you can use toward audit and regulators. Your organization meets the regulatory framework itself; SQACE supplies reproducible evidence for it.
We do not claim certificates we cannot back up. We tell you the current certification status in the security review. What we deliver are the concrete documents for your review team: a data-flow diagram, a control and measures list, a data processing agreement, a sub-processor list for the EU-cloud option, architecture and deployment documentation, and a penetration-test summary, on request and under NDA.
Take SQACE through your security review.
In a security review we walk through the architecture, the permission concept and the operational details in full, and we put the review pack on the table. Or take a look first at what SQACE costs.