This policy sets out how Onbridge collects, handles, stores, transmits and deletes client documentation and associated data. It applies to all data received from clients in connection with our onboarding facilitation service. We collect only what is necessary and retain it only for as long as required.
Onbridge provides institutional exchange onboarding facilitation services. Our service enables institutional clients to complete the KYB onboarding process across multiple cryptocurrency exchanges by submitting a single consolidated document package to us.
Onbridge acts solely as a document management and submission service. We do not provide financial, investment, or legal advice. We do not hold, custody, or transact virtual assets on behalf of clients.
Client data is used exclusively for the following purposes:
We do not use client data for marketing, analytics, or any secondary commercial purpose. We do not sell or license client data to any third party.
All client documents are stored exclusively on Tresorit, a Swiss-based, enterprise-grade document management platform. Tresorit's zero-knowledge architecture means files are encrypted on your device before upload. Not even Tresorit can access your documents.
We are transparent that it is Tresorit as our infrastructure provider, not Onbridge as an organisation, that holds these certifications. We are happy to provide Tresorit's full certification documentation to your compliance team on request.
All document activity is logged and retained, including the date and time of every upload, access, download and deletion event, the identity of the team member who performed each action, and the IP address associated with each access. Audit logs are retained for a minimum of five years and are available to clients upon request.
| Document type | Retention period |
|---|---|
| Active engagement documents | Duration of engagement plus 12 months |
| Submitted onboarding packages | 5 years from date of submission |
| Audit logs and access records | 5 years from date of record creation |
| Unsuccessful onboarding documents | 12 months from final determination |
| Documents subject to legal hold | Until hold is lifted, then standard period applies |
You may request deletion of your documents at any time. Deletion requests are fulfilled within 30 calendar days, subject to any legal retention obligations. Deletion is logged in our audit trail.
We engage the following categories of third-party service providers who may process client data on our behalf:
All service providers are subject to appropriate data processing agreements and are required to maintain security standards no less stringent than those set out in this policy.
Requests should be submitted to hello@onbridge.io. We will acknowledge receipt within 5 business days and fulfil requests within 30 calendar days.
In the event of an actual or suspected security incident affecting client data, we will investigate and contain the incident within 24 hours of detection. Affected clients will be notified within 72 hours of confirming that their data has been or may have been compromised. A post-incident report will be prepared within 14 days and made available to affected clients upon request.
To report a suspected security incident, contact us immediately at hello@onbridge.io.
This policy is reviewed annually or upon any material change to our operations, technology infrastructure, or regulatory environment. Clients will be notified of any material changes with a minimum of 30 days notice. The current version is always available at onbridge.io/data-policy.html.
All data handling queries, access requests, or concerns should be directed to hello@onbridge.io or in writing to [Registered Address], Dubai, UAE. We respond to all queries within 5 business days.