Preview. The API is shared with design partners and may change before launch. Register interest for sandbox access.
Compliance
Phew is pre-launch. This page lists what we have in place today and what’s in progress or planned before and after general availability. We’ll keep it up to date as items move.
In place means implemented and running. In progress means work has started. Planned means committed on our roadmap.
Security controls
Section titled “Security controls”| Control | Status |
|---|---|
| TLS 1.2+ on every endpoint, HSTS | In place |
| Encryption at rest for databases and file storage | In place |
| Secrets in managed storage, never in source control | In place |
| Bot protection and rate limiting on public forms | In place |
| One-time links stored as hashes, single use, short expiry | In place |
| Strict schema validation on every API input | In place |
| Structured logging with request IDs | In place |
| Automated lint, type checks, tests and migration checks before every deploy | In place |
OAuth 2.0 with private_key_jwt and mTLS, RFC 9421 signing |
In progress |
| EU data residency for all persistent data | In progress |
| Tamper-evident audit log of security-relevant actions | Planned |
| Independent penetration test, with summary shared with partners | Planned Before GA |
Certifications and frameworks
Section titled “Certifications and frameworks”| Framework | Status | Notes |
|---|---|---|
| GDPR | In place | DPA available; see Data protection |
| SOC 2 Type II | Planned | Controls designed to the Trust Services Criteria; audit to follow GA |
| ISO/IEC 27001 | Planned | Information security management system to follow SOC 2 |
| PCI DSS | Not applicable | Phew never stores, processes or transmits cardholder data |
Financial services regulation
Section titled “Financial services regulation”Insurance distribution. Cover is underwritten by a licensed Nordic insurer. Phew distributes it as an intermediary, and partners that show the offer take part in that distribution. We provide the product documents and the customer journey requirements in Your responsibilities.
DORA. Financial entities in the EU and EEA must manage the risk of their ICT third-party providers under the Digital Operational Resilience Act. Planned We will support DORA-required contractual terms for partners that are financial entities, including audit and access rights, incident notification, exit support and subcontracting transparency.
Outsourcing. Where your regulator treats Phew as an outsourcing arrangement, we’ll work with your compliance team on the information they need.
Requesting documents
Section titled “Requesting documents”Partners can request our security questionnaire answers, architecture overview, DPA and sub-processor list from security@getphew.com.