Boli ships software. Not licenses.
Stripe is not a bank. Twilio is not a telecom carrier. Plaid is not a financial institution. Boli is not a financial institution either. Every regulated activity in the stack is performed by the customer or a licensed partner.
What's regulated. And who holds it.
Boli is on the hook for software quality, uptime, security, and data protection. The customer (issuer, law firm, fund admin, transfer agent, project developer, registry, or government agency) is on the hook for the regulated activity it chooses to perform.
Contractual scope.
- ✓ SOFTWARE CORRECTNESS
The code does what the customer tells it to do. Compliance primitives behave as configured; settlement primitives are atomic; MRV oracles report what the upstream provider attested.
- ✓ UPTIME AND OPERATIONAL SLA
Region-isolated, multi-tenant or dedicated deployments with published SLAs and transparent incident history.
- ✓ SECURITY AND AUDIT POSTURE
SOC 2 Type II, ISO 27001, penetration testing, signed smart-contract audits, and continuous third-party monitoring of production workloads.
- ✓ DATA PROTECTION
GDPR, UK GDPR, and India DPDP-aligned. Encryption at rest and in transit, key-management integrations with customer HSMs, right-to-erasure workflows.
What Boli does not warrant.
- Fitness of the customer's offering for any specific jurisdiction
- Suitability of any security for any investor
- That any downstream venue, bridge, or custodian remains operational or licensed
- Regulatory outcomes — the customer's counsel signs off on filings, not Boli
Need our compliance & security package?
We share our SOC 2 report, ISO 27001 certificate, penetration-test summaries, threat model, and audit history under NDA. Reach out with your counsel and we'll get you a data-room link.