Security and privacy

The AC gateway acts as a controlled intermediary between authorised clients and the lending platform. Clients access the AC API rather than connecting directly to the underlying provider.

Key controls

• HTTPS transport and separate client ID/API key authentication.
• Server-side downstream routing and campaign configuration, which clients cannot select.
• An XML allowlist, duplicate-field rejection and protections against unsafe XML and arbitrary URL forwarding.
• Short-lived client-bound results tokens and restricted results destinations.
• Technical request IDs and sanitised operational logging.

Data handling

The AC relay is stateless for raw customer applications and lender responses. It records sanitised technical metadata for operations and security but does not intentionally archive complete application XML or lender-offer XML.

This is not a promise of a full application-record repository at AC. Record-retention responsibilities and access to evidence for audits, complaints and regulatory enquiries must be agreed separately with each client and the downstream platform.

Your responsibilities

• Collect and transmit customer personal data only under the appropriate legal basis, permissions and privacy notices.
• Keep credentials secret and avoid exposing them to browser users.
• Protect returned offers and lender redirects within your customer journey.
• Retain necessary customer/application records under your own legal and contractual obligations.
• Do not log API secrets, raw sensitive XML or results tokens in routine application logs.

For incident coordination, use the AC technical contact established during onboarding.