UK US
Book a demo
Security

Security isn't a feature. It's the foundation.

Taking security and privacy seriously.

Knowa powered by PSCA serves US plan sponsors, investment committees, and the advisors who support them. Security is designed into the platform from the start. Built around documented controls and independent ISO 27001 certification.

A board works above three interlocking foundation layers while a custodian manages the entrance.
Certification and control frameworks

The frameworks Knowa powered by PSCA is built to.

ISO 27001
Certified
NIST CSF
Aligned
ERISA 404(a)
Ready
US Hosted
Infrastructure
SOC 2
Aligned

Our posture

Every organization using Knowa expects its data to remain private and protected.

We continuously strengthen Knowa to meet the evolving challenges of security and cyber threats. Every organization using our platform expects its data to remain private and protected, and we've built Knowa with that responsibility at its core.

Knowa is ISO 27001 certified and designed in alignment with the NIST Cybersecurity Framework and the fiduciary record-keeping expectations of ERISA 404(a) and DOL audits.

While we don't disclose sensitive details about our defenses, transparency matters. Below, we've outlined the key measures and standards that ensure Knowa remains a secure, compliant, and trusted environment for our clients.

01
Data Encryption
All user data is protected in transit and at rest. We use FIPS 140-2 certified AES-256 encryption at rest and TLS 1.3 in transit, with ECDSA and RSA algorithms. Encryption keys are managed under strict access controls with regular rotation.
02
Server & Infrastructure
Knowa is hosted on tier-one cloud infrastructure with physical security, redundant power, and 24/7 monitoring. Servers are hardened to industry benchmarks with continuous patching, intrusion detection, and automated failover. Separate production, staging, and development environments.
03
People & Access
All staff undergo background checks and sign confidentiality agreements before access to production. Access follows least-privilege principles. Privileged access is reviewed quarterly and revoked immediately on role change. Staff receive annual security and data-protection training.
04
Logging & Monitoring
Every authentication, access, and administrative action is logged with tamper-evident timestamps. Logs are retained in immutable storage. Anomaly detection monitors for suspicious patterns. Security events escalate to on-call engineers with defined response times.
05
Development & Testing
Secure software development lifecycle with mandatory peer code review, automated static analysis, and dependency vulnerability scanning. Independent penetration testing is conducted at least annually. Security fixes prioritized by severity with tracked remediation SLAs.
06
User Access & Authentication
Customers control their own users, roles, and permissions. Multi-factor authentication available for all accounts. Single sign-on (SSO) supported for enterprise customers. Session management, password policies, and account lockout aligned to NIST guidance.
07
Custom Governance Controls
Administrators can configure permissions per-workspace, per-document, and per-user. Sensitive records can be restricted to named individuals. Full audit trail for every access, edit, download, and share. Data residency and retention policies configurable to your organization's requirements.

For your security review

The detail your team needs to check.

Ask for the current security review pack. Tell us your organization, preferred hosting region and any questions from your IT, privacy or procurement team.

Certification and scope

Knowa is ISO 27001 certified. Request the current certificate, its scope, issuing body, validity dates and Statement of Applicability. NIST CSF and SOC 2 alignment describe control frameworks; they are not additional certifications or a claim to a SOC 2 attestation.

Hosting and data locations

For your US deployment, ask us to confirm the primary hosting region, backup locations and any processing in other countries. The review should cover both the platform and the services it uses.

AI processing

Ask which providers process each AI feature, where that processing takes place, how long inputs and outputs are retained and how model-training restrictions are applied. Review these arrangements alongside the permissions and human review controls.

Subprocessors and contracts

Request the current subprocessor list and Data Processing Addendum, including each provider's purpose, location, transfer arrangements and the process for notifying you of changes.

Retention, export and deletion

Agree the retention period for your records, backups and any Archive service. Ask how you export your information, end access and request deletion when the contract ends.

Testing and response

Ask for the available independent testing summary, remediation process and incident-notification arrangements. Include any questionnaire your team needs us to complete.

Request the security review pack

Include your organization and the areas you want to review. We can discuss access to supporting documents with your security team.

Security you can stand behind. Fiduciary confidence you can rest on.

See how Knowa powered by PSCA brings enterprise-grade security to every investment committee, plan sponsor, and advisory firm.

Book a demo →