Authenticated identity
Users sign in through an OpenID Connect identity provider. The organisation a request acts for is taken from the authenticated session, never from uploaded data.
Governance & Security
Built for governed collateral monitoring
The Collateral Monitor keeps a lender's portfolio data in a tenant-private domain, separate from the shared market evidence Panoperty maintains, and records how every output was produced.
Two domains, deliberately separated
Asset-level evidence is built around a lender's own coordinates, so it is treated as tenant data. It is stored on the tenant side and never written into the shared observation store.
Tenant-private domain
- portfolio
- immutable snapshot
- exposures
- asset · attribute · period evidence
- ranking
Tenant records are never written into the shared domain.
Shared Panoperty domain
- governed market observations
- market centre · cohort
- measurement period
- source · provenance
Tenant-specific coordinates, exposures and asset-level evidence remain in the tenant-private domain.
Controls in the application
Tenant isolation
Every read and write of portfolio records, evidence, ranks and exports is scoped to the authenticated organisation.
Immutable snapshots
Each tape is committed as a snapshot identified by portfolio, as-of date and source-file hash. Committed rows are not edited; a new tape creates a new snapshot.
Idempotent ingestion
Submitting an identical file again returns the existing snapshot. Re-running a monitoring period replaces that period's results rather than duplicating them.
Rejected rows and reconciliation
Rows that fail validation are kept with a stated reason. Row counts and exposure totals are reconciled across accepted and rejected rows before commit.
Fixed-precision money
Loan exposures and collateral values are parsed as fixed-precision decimals to four places, avoiding floating-point rounding in stored amounts.
Provenance and versioning
Evidence records carry measurement period, pool size, comparator distance, location source, evidence state and calculation version. Ranks store their components.
Controlled exports
Queue exports are available only to authenticated users and contain only their organisation's records.
Deletion audit
When a portfolio is deleted, its snapshots and derived evidence are removed together and the deletion is recorded in an audit log.
What we do not claim
This page describes controls implemented in the Collateral Monitor application. It makes no claim of third-party security certification or regulatory approval.
Portfolio data is not collected through this website. A portfolio assessment begins with a conversation. Any sharing of portfolio data is subject to terms agreed separately.
Review Panoperty's controls with your team
Talk through tenant isolation, provenance and data handling with your risk and security reviewers as part of a portfolio assessment.