Kartula is a tool for regulated professionals, and it's built like one. Here is plainly how your data is held, who controls it, and how the things a supervisor asks about are answered in the architecture rather than in a promise.
Every action — a login, a review, an export, a decision — is written once and never rewritten. The application has no path that edits or deletes an entry; a correction is appended.
Your data and every sub-processor stay in the EU. No third-country transfer happens without being assessed and disclosed to you first.
Each customer's data is fenced off in every query the application makes, and integration tests prove one tenant can't read another. Your client list is yours alone.
Passwords are hashed; a login email in the audit trail is stored only as a one-way hash. We minimise what's kept, and keep no secret it doesn't need.
A deterministic core does the detection, and no model decides anything. Where AI is added, it drafts at the edges only — labelled, and reviewed by a person before it counts.
The audit trail keeps ids, outcomes and hashes — not free text or names where an id will do. Less personal data held means less at risk.
For the client data you run through Kartula, you are the data controller — you decide the purpose, under your own anti-money-laundering obligation. Kartula acts as your processor, handling that data on your instruction under a data-processing agreement. For our own operational data — your account, security and audit logs — we are the controller.
Your AML obligation stays with you; a tool can't assume it. That's not a limitation — it's the honest, defensible position, and it's why Kartula surfaces, drafts and assists, but never decides, files or clears on its own.
What you'll get for your file: a data-processing agreement, signed before any of your data goes in, with a record of the sub-processors we use and a clear statement of what data Kartula holds, on what basis, and for how long — the paperwork your DPO or supervisor will expect. Ours is being drafted, and we will go through it with your DPO.
Luxembourg's beneficial-ownership register is not open to vendors. Professional access is bound to the professional who holds it, so a service provider cannot lawfully sit outside that access and re-serve the data to you.
Kartula therefore stays inside your own professional access, as your processor: you make the lookups you are entitled to make, and Kartula records what you were shown and compares it with the client's declarations and the published records. Where a chain is reconstructed from published records (GLEIF) rather than the RBE, it is labelled as exactly that, so nothing in a file claims a provenance it does not have.
If a vendor offers you bulk Luxembourg beneficial-ownership data, ask them on what basis they hold it. It is a short conversation, and it is worth having before their answer becomes your finding.
The audit trail is split into two horizons so nothing is kept longer than it needs to be: activity that supports your AML record-keeping obligation is held to that horizon, and pure security events (logins, IP addresses) are kept for a shorter, proportionate window. When the obligation lapses, a scheduled, self-auditing purge removes what's past its retention.
An append-only trail can't be quietly edited — that's the point. If something recorded is wrong, the correction is appended: a new entry that references the original and states what's right. The history stays intact, and the correction is on the record too. It's how rectification works on an evidence trail you can trust.
The parts of Kartula that decide anything — change detection, screening matches, risk logic — are deterministic and testable. No language model is in that path, and today none is in Kartula at all. If one is added, it will only draft at the edges — a first suspicious-activity-report narrative, say — marked as a draft and reviewed by a person before it counts. No customer data is used to train models, and no consequential decision is automated.
Kartula is built on official, openly-reusable sources where it can be — filed annual accounts, legal-entity identifiers, the public sanctions lists. Where a source carries its own licence (certain PEP feeds, commercial financial data) it's a clearly-labelled part of your plan, not something quietly re-sold. And where a register sits behind an access control, we use the lawful route — your own access, or an official channel — rather than scraping it.
The demo and message forms on this site keep what you send: your name, e-mail address and firm, a phone number if you give one, the answers you choose, your message, the page and language you wrote from, the time, and your IP address shortened to its network prefix. We use it only to reply. It is not shared and not added to a mailing list, and it is deleted a year after you sent it.
Like any web server, this site also keeps an access log for security, with full IP addresses, for 14 days.
AMLR — the EU's single AML regulation — applies from 10 July 2027, with the new authority AMLA behind it. Kartula's perpetual-KYC model, harmonised CDD/EDD case files and goAML-format reporting are shaped for that regime, so adopting it now is a step toward the new standard rather than something to redo.
We're happy to walk through the data flows, the DPA and the audit model in detail.