• SOC2 Type 2 and ISO27001 certifications initiated
  • Strict implementation of EBA guidelines for essential outsourced services :
    • Audit rights for the customer and the regulator
    • Open subcontractor list for Marble, subject to the same guidelines and customer’s approval (sub-outourcing framework agreement)
    • Reversibility of the service
    • Service Level Agreement
    • Monitoring of EBA policies to continue to meet the new standards
  • GDPR compliant
    • All data hosted in EEU
    • Privacy by design

Access and organizational security

  • Authentication: we have Single Sign On (SSO), 2-factor authentication (2FA) and strong password policies to ensure access to Marble’s cloud services and SaaS are protected.
  • Password Managers: all company-issued laptops have a password manager in place for team members to manage passwords and maintain password best practices.
  • Permissions: access to cloud infrastructure and other sensitive tools are limited to authorized employees who require it for their role.
  • Security policy deployed (for travels, out-of-office work, in-office practices, laptop configurations, and encryption)
  • Least privileged access control:
    • Production account is only accessible by Senior DevOps employees, on a need-to-do basis
    • No manual access for ordinary operations
    • Minimally scoped permissions for apps running

Internal technical security

  • Security hardening: Policy of least necessary privilege, reduction of attack surface
  • Web application firewall: all traffic transits through a load balancer with Cloud Armor WAF enabled
  • Static code scanning (library vulnerabilities with Dependabot, secret scanning, github CodeQL + Bearer SAST) and docker images scanning (GCP Artifact registry)
  • Third-party penetration testing: we work with independent security consultants to conduct regular penetration tests on all parts of our system.
  • Auditability (log trails)

3rd party providers

  • Up-to-date list of 3rd party services used with production data can be provided on request at any moment
  • Current list is:
    • GCP (servers located in the EU, with the EBA Financial Services Addendum)
    • Mixpanel (servers located in the EU - does not treat end user data)
    • Segment (servers located in the EU - does not treat end user data)
    • Metabase (servers located in the EU - does not treat end user data)
    • Microsoft Azure (does not treat end user data)


  • Cloud-native platform hosted in the EU on GCP: all our services are hosted with Google Cloud Platform (GCP) in Europe (mainly France and Belgium). For more information please visit GCP Security.
  • Data encryption: data is encrypted at rest and in transit using state-of-the-art standards (compatible TLS 1.3, AES256)
  • Data isolation:
    • Specific GCP account for production on which only Senior DevOps employees have access
    • Option to store ingested data on a distinct database instance from other customers (contact us)
  • Data integrity:
    • Multiple backups of data (daily DB backups, write-ahead log archiving, deletion protection, multi-zone DB instances with replicas in a distinct region)
    • Rigorous permission controls on data access by API clients


Marble open-source

Most of the information below only applies for the Marble SaaS. If you are using Marble open-source or on premises, you are responsible for your organization's and infrastructure's security.