Kloom supports OFAC SDN screening and secondary-sanctions obligations. The Name Intelligence engine matches against designated-party lists in the original script — no lossy transliteration at index time — returning coherence and certainty as two independent axes so teams can distinguish a disqualified non-match from an underdetermined one. Standing queries fire automatically on list updates.
Kloom supports BSA/AML programme requirements through its append-only evidence layer, session-pinned investigations, and structured audit stream. The continuous KYC surface re-evaluates customers as the graph and watchlists evolve — without re-running onboarding from scratch — and produces an evidence basis suitable for SAR support documentation.
Kloom’s enhanced due-diligence surface supports PEP screening, beneficial ownership traversal through multi-hop graph queries, and adverse-media monitoring with per-mention provenance. Evidence is append-only and addressable — every element of a due-diligence file points back to a citable source document.
UK-authorised firms must document customer risk assessments and demonstrate ongoing monitoring. Kloom’s session-pinning and tamper-evident forensic audit stream are designed to produce the evidence basis a Financial Crime Guide-style review expects. Deployment posture options include UK data residency under the self-hosted Enterprise Edition.
Data-subject rights are the most nuanced area here, because Kloom’s append-only evidence layer means deletion is not a silent row removal. The data-subject rights section below explains how access, erasure, rectification, and portability requests interact with the graph — and where the legal assessment belongs with your DPO, not with us.
Kloom’s evidence layer is append-only by design — new observations never overwrite old ones. This is what makes investigations replayable and audits defensible. It also means that a deletion request cannot simply remove a row from a table.
When an erasure request arrives, Kloom appends a suppression record — an explicit tombstone that causes the mention and derived claims to be excluded from future resolution queries. The underlying evidence is not physically removed from the forensic log; it is suppressed at query time.
Whether this satisfies the right to erasure under GDPR depends on your jurisdiction, your lawful basis for processing, and whether a law-enforcement or AML exception applies. We document the behaviour plainly so your DPO can assess it — that assessment is theirs to make, not ours.
Returns all mentions, attributes, and suppression records associated with the data subject’s identifier. The full evidence trail is surfaced — including any prior rectification or erasure requests.
A suppression tombstone is appended to the evidence chain. Future resolution queries exclude the mention and any derived claims. The forensic log is not truncated — the tombstone is the evidence of the request.
A correction record is appended and takes priority in resolution queries. The original mention is preserved in the forensic stream. Both the original and the correction are visible on an access request.
All mentions and attributes associated with the subject’s identifier are available as a structured JSON export via the Immutable Evidence API — in a machine-readable format suitable for re-submission to another controller.
The Open Core hosted offering runs on cloud infrastructure in the region you select at provisioning. Evidence corpora are not replicated across regions by default.
For organisations with strict residency requirements — GDPR Article 44 transfer restrictions, UK data localisation preferences, or deployment boundaries that preclude third-party cloud — the Enterprise Edition is self-hosted on your own infrastructure. Evidence never leaves your network, and Kloom has no operational access.
If your residency requirement falls outside the options below, reach out — we can discuss a dedicated-region hosted arrangement under a separate data-processing agreement.
The list below covers subprocessors with access to personal data ingested via the hosted Open Core offering. Self-hosted EE deployments have no Kloom-designated subprocessors — all third-party relationships are yours. Last updated May 2026.
Procurement reviewers can tell when a compliance page is bluffing. We list what we have, what is in progress, and what we have not yet pursued — with no implication that a listed regime is equivalent to having a control in place. Underclaiming is recoverable. Overclaiming is not.
Compliance reviewers can request the current DPA, subprocessor list updates, a pre-deployment assessment, or a technical briefing on data-subject rights handling. Reach us at compliance@kloom.ai.