Snapshot 4493
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center
Start your security review
View & download sensitive information
Ask for information
Overview
At FrankieOne, your trust is our top priority. We understand the significance of data security in today's digital landscape and are dedicated to safeguarding your data with the utmost care. Our commitment to security is unwavering, and we employ comprehensive systems and protocols to ensure the protection of the information you entrust to us.
This commitment spans our entire services - KYC, KYB, IDV, AML/CTF, OneSDK, Fraud & Transaction Monitoring, Portal. These robust security measures are designed to safeguard the sensitive data and processes across all our solutions.
Within this Trust Centre, you'll find detailed insights into our data security practices and the robust procedures we've established. We aim to offer transparency about our security measures and to reinforce the confidence you place in FrankieOne.
Compliance
GDPR
ISO/IEC 27001:2022
SOC 2
BIMI
Frankie One is reviewed and trusted by
ANZ Bank
Commonwealth Bank of Australia
Westpac
Qantas
Finder
BTC Markets
Cointree
MYOB
Shopify.com
Afterpay
Kraken
Binance
Documents
Featured Documents
COMPLIANCESOC 2
COMPLIANCEISO/IEC 27001:2022
APP SECURITYApplication Penetration Testing
LEGALCyber Insurance
Knowledge Base (FAQ)
Describe your organisation penetration testing approach and frequency? Please provide the latest penetration testing report.
Does your organisation hold any certifications? For example, ISO/IEC 27001, Privacy Shield, ISO9001, Cyber Essentials.
Explain how your organization handles data privacy in compliance with the Australian Privacy Act 1988 and the Notifiable Data Breach scheme.
Do you use encryption for external/internal information transmissions (i.e., over the network/internet)? What encryption standard do you use?
Has your organization experienced any information security incidents or breaches in the past 24 months? If so, what controls were implemented to mitigate risks from these breaches?"
View more
Risk Profile
Data Access LevelRestricted
Impact LevelSevere
Recovery Time Objective2 hours
View more
Policies
Acceptable Use Policy
Anti Bribery Policy
Asset Management Policy
View more
Reports
Other Reports
Pentest Report
SOC 2 Report
Product Security
Audit Logging
Data Security
Integrations
View more
Data Security
Access Monitoring
Certificates of Destruction
Data Asset Classification
View more
App Security
Responsible Disclosure
Application Penetration Testing
Code Analysis
View more
Legal
Subprocessors
Customer Audit Rights
Cyber Insurance
View more
Access Control
Access Log Management
Bring Your Own Device (BYOD)
Data Access
View more
AI
AI Security
AI Overview
AI Training Data and Bias
View more
Data Privacy
Cookies
Data Breach Notifications
Data Into System
View more
Infrastructure
Cross Environment Security
Security Information and Event Management
Status Monitoring
View more
Endpoint Security
Anti-Malware
Disk Encryption
Endpoint Detection & Response
View more
Network Security
Bot Detection
Data Loss Prevention
Distributed Denial of Service Protection (Anti-DDoS)
View more
Corporate Security
Asset Management Practices
Email Protection
Employee Training
View more
Incident Response
Incident Response Plan
Designated Response Personnel
Forensic Retainer
View more
Risk Management
Data Access/Impact Levels
Risk Assessments
Supply Chain Risk Management
View more
Asset Management
Asset Classification
Asset Inventories (Hardware/Software)
Asset Tracking
View more
BC/DR
Alternate Processing/Storage Site
Business Continuity Management System (BCMS)
Business Continuity Plan (BCP)
View more
Training
Security Awareness Training
Employee Privacy Training
Phishing Training
View more
Change Management
Change Advisory Board (CAB)
Change Management Program
Changes Notification & Verification
View more
ESG
Anti-Bribery and Corruption
Anti-Modern Slavery
Code of Ethics
View more
Security Grades
Qualys SSL Labs
Qualys SSL Scan
A
Subprocessors
Trust Center Updates
Mini Shai-Hulud / TanStack npm and PyPI Supply Chain Campaign
Vulnerabilities
Mini Shai-Hulud / TanStack npm and PyPI Supply Chain Campaign
What happened: On 12 May 2026, the TeamPCP threat group ran a coordinated supply chain attack ("Mini Shai-Hulud") against the npm and PyPI ecosystems. Several malicious versions of packages were published across the @tanstack, @uipath, and @mistralai npm namespaces, as well as two PyPI packages (mistralai 2.4.6 and guardrails-ai 0.10.1). The payload targeted cloud credentials, CI/CD secrets, SSH keys, and GitHub and npm tokens, and used stolen CI/CD tokens to self-propagate to additional downstream packages. The compromised versions were available for approximately 20 minutes before external researchers detected the attack.
FrankieOne's response:
Impact assessment: We conducted a comprehensive Software Bill of Materials (SBOM) audit across all FrankieOne repositories, covering every package implicated in the campaign. No compromised package versions were present in any FrankieOne system, and no FrankieOne or customer data were affected.
GitHub Actions hardening: We reviewed our CI/CD workflows for related supply chain risks. Third-party GitHub Actions are pinned to specific commit SHAs in line with GitHub's own security recommendations, preventing attackers from introducing malicious code via tampered action versions.
Detection improvements: Indicators of Compromise (IOCs) published by StepSecurity, Socket, and Wiz, including attacker infrastructure domains such as filev2.getsession.org, api.masscan.cloud, and git-tanstack.com, have been added to our application security scanners and endpoint detection tooling to ensure early detection of any future related activity.
Impact Assessment: Supply Chain Attack Response - LiteLLM & axios
Vulnerabilities
Status: ✅ Reviewed & Remediated - No customer impact
Overview
FrankieOne's security team has completed a thorough review in response to two significant open-source supply chain attacks that emerged in late March 2026. Both attacks targeted widely-used packages and affected organisations across the industry. We want to be transparent with our customers about what happened, what we did, and what it means for you.
Incident 1: LiteLLM PyPI Compromise (March 26, 2026)
What happened: The maintainer account for LiteLLM - a widely used Python library for interfacing with LLM providers such as OpenAI and Anthropic - was compromised. Attackers published two malicious versions (1.82.7 and 1.82.8) to PyPI containing a multi-stage credential-stealing payload. The malware targeted environment variables, cloud credentials (AWS, GCP, Azure), SSH keys, Kubernetes configs, CI/CD secrets, and database credentials, exfiltrating them to attacker-controlled infrastructure. The malicious versions were available for approximately two hours before removal.
FrankieOne's response:
✅ Impact assessment: We conducted a comprehensive audit of all our repositories and found no usage of the compromised LiteLLM versions (1.82.7 or 1.82.8). No FrankieOne systems or customer data were affected.
✅ GitHub Actions pinning: We performed a review and hardening of our CI/CD pipeline by pinning all third-party GitHub Actions to specific commit SHAs, in line with GitHub's own security recommendations. This prevents attackers from introducing malicious code via tampered action versions and ensures we only run workflows we have explicitly audited and approved.
✅ Detection improvements: The Indicators of Compromise (IOCs) and event detection rules for this attack have been added to our application security scanners to ensure early detection of any future related activity.
Incident 2: axios npm Compromise (March 31, 2026)
What happened: The npm account of the lead axios maintainer - axios being one of the most widely downloaded JavaScript HTTP client libraries with over 300 million weekly downloads - was hijacked. Two malicious versions were published: axios@1.14.1 and axios@0.30.4. Both versions injected a malicious dependency (plain-crypto-js@4.2.1) that deployed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux. The malware contacted attacker-controlled infrastructure and self-destructed after execution to avoid forensic detection. npm removed both versions shortly after discovery.
FrankieOne's response:
✅ Impact assessment: We audited all repositories in our GitHub organisation and confirmed that none of our codebases referenced or resolved the malicious axios versions (1.14.1 or 0.30.4). No FrankieOne systems or customer data were affected.
✅ Package lockdown: We have pinned axios to a verified stable version and disabled automatic updates for the package, preventing any unreviewed future versions from being pulled into our builds.
✅ Detection improvements: The IOCs and event detection rules for this attack - including the C2 domain sfrclak[.]com and associated filesystem artifacts - have been added to our application security scanners.
What This Means for Our Customers
At this time, FrankieOne has found no evidence of compromise in relation to either attack. There has been no unauthorised access to customer data and no impact to the FrankieOne platform or services.
These incidents are a reminder of the systemic risk posed by open-source supply chain attacks. FrankieOne takes a proactive, defence-in-depth approach to supply chain security, including continuous dependency scanning, CI/CD hardening, and active monitoring of threat intelligence feeds.
SOC 2 Type II Attestation Achieved
Compliance
We’re pleased to share that we have successfully completed our SOC 2 Type II audit. This independent assessment confirms that our controls and processes operated effectively over the audit period, in alignment with the Trust Services Criteria for security, availability, and confidentiality. Please download the latest report from this Trust Center.
Achieving SOC 2 Type II demonstrates our ongoing commitment to protecting customer data and maintaining strong security and compliance practices.
Impact Assessment of critical vulnerability related to React Server Components (CVE-2025-55182 , CVE-2025-66478)
Vulnerabilities
We have completed our detailed impact assessment of this vulnerability and found that there is no usage of impacted React Server Components within our environment.
Also, Cloudflare, our WAF provider, has deployed rules preventing the exploitation of this vulnerability - https://blog.cloudflare.com/waf-rules-react-vulnerability/
Welcome to our Customer Trust Center!
General
Welcome to our new FrankieOne Trust Center. We take security and privacy seriously. This page provides clear, up-to-date details on our controls, certifications, and policies to support your evaluation with confidence.
If you think you may have discovered a vulnerability, please send us a note.
Report issue