Security Statement
Implemented security controls and the shared-responsibility model for L'OR Analytics.
Important legal-review notice
This document describes the current beta application's intended operating practices. It should be reviewed by qualified legal counsel before production adoption. If this document conflicts with a signed customer agreement, the signed agreement controls to the extent of that conflict.
Security approach
L'OR Analytics uses a layered security and audit approach proportionate to a service whose report inputs are principally public institution-level regulatory data. Security controls reduce risk but cannot eliminate it, and this statement is not a guarantee, certification, or independent attestation.
Implemented controls
- HTTPS transport for the public beta service.
- Access-controlled administrative and reviewer functions.
- Object-storage encryption and time-limited signed download links for report delivery.
- Report-package manifests, file counts, and SHA-256 integrity attestations.
- Input validation, bounded logo retrieval, and controls intended to prevent access to private network addresses.
- Immutable or append-only evidence for disclosure acknowledgements, reviews, delivery actions, and selected workflow events.
- Separation of beta and production deployment workflows and human authorization before report delivery.
Payments and service providers
Payment-card entry is handled through the configured payment provider; L'OR Analytics records payment and checkout references needed to verify access rather than intentionally collecting full payment-card numbers in the report request. Infrastructure, storage, email, and AI service providers may process limited information to perform contracted functions.
Downloads and malware
Report packages are generated by controlled application workflows and delivered by link rather than unsolicited executable attachment. Integrity hashes help detect unintended package changes, but they do not constitute antivirus certification. Recipients should use current endpoint protection, verify the expected sender and domain, avoid forwarding links unnecessarily, and contact us if a message or download appears suspicious.
Shared responsibility and reporting
Users are responsible for authorized recipients, endpoint security, downloaded copies, and compliance with their own vendor-management and information-security requirements. Suspected security issues should be reported to reports@ubpranalytics.com with sufficient detail for investigation; do not include credentials or sensitive customer data.