Security & Compliance
Your money deserves
serious protection.
We are building Kiwi Grow with security at the foundation, not as an afterthought. Here is exactly how we protect your data and why we are taking our time to get this right.
Data Security
Every piece of data that travels between your device and Kiwi Grow is encrypted using TLS 1.2+ (Transport Layer Security), the same standard used by leading banks and financial institutions worldwide.
Data stored on our servers is protected with AES-256 encryption at rest, a military-grade standard that would take billions of years to crack with current computing power.
We follow the principle of least privilege: only the systems and people who absolutely need access to specific data have it, and every access is logged and audited.
Our encryption standards
- In transit: TLS 1.2+ for all API calls, web traffic, and data transfers
- At rest: AES-256 encryption for all stored personal and financial data
- Authentication: Industry-standard hashing algorithms for all credentials
- Infrastructure: Hosted on SOC 2 compliant cloud infrastructure
A Note on Transparency
From our Founder
We are currently in the process of vetting world-class fund managers to partner with. We are not rushing this, because your money is too important to leave to chance.
Every fund manager we evaluate must meet our standards for regulatory compliance, track record, transparency, and alignment with the goal-based savings philosophy that Kiwi Grow is built around.
We believe that taking the time to get this right is not a delay. It is a feature. When Kiwi Grow launches, every aspect of the platform, from the technology to the partnerships, will have been built to earn and keep your trust.
Harrish Selvarajah
Founder, Kiwi Grow
Regulatory Roadmap
Kiwi Grow is being designed to align with both local and international standards for financial technology platforms. We are building toward compliance, not retrofitting it.
SEC Sri Lanka Guidelines
All investment products offered through Kiwi Grow will be managed by fund managers licensed and regulated by the Securities and Exchange Commission of Sri Lanka.
KYC & AML Compliance
We are building robust Know-Your-Customer and Anti-Money Laundering processes into the platform from day one, in line with Financial Intelligence Unit (FIU) requirements.
Data Protection (PDPA)
Our data handling practices are designed to comply with the Sri Lanka Personal Data Protection Act (No. 9 of 2022), giving you full control over your personal information.
International Security Standards
Our infrastructure and engineering practices align with internationally recognised frameworks including SOC 2 principles and OWASP security guidelines.
Got a question?
We are happy to answer any questions you have about how we protect your data.