SD-WAN & SASE for Financial Services

Cloudflare for Financial Services

Named service:

Cloudflare (Bot Management, API Shield, WAF, DDoS protection, Workers AI, AI Gateway)

Regulatory regime:

Not stated

Cloudflare empowers over 1,700 financial services organizations to deliver secure digital experiences

Cloudflare states it serves over 1,700 financial services organisations and lists application security products; no SD-WAN/SASE product is named on this page and no individual customer is described.

Does not prove: Generic industry solutions page with no named customer and no Cloudflare One/Magic WAN/Access naming; does not prove any deployment, only market presence and a generic sovereignty mention.

cloudflare.com · Checked 12 Sept 2026 · Supports: Data residency and sovereignty

Investec & Cloudflare | Case Study | Cloudflare

Named financial institution:

Investec

Named service:

Cloudflare Workers, Cloudflare Access, Cloudflare Application Services

Countries, regions:

South Africa, United Kingdom

Regulatory regime:

Multiple

Outcome:

Cloudflare makes us proactive rather than reactive

Cloudflare makes us proactive rather than reactive - we can take a long-term strategic approach to security while remaining nimble

Investec, an international bank operating from South Africa and the UK, uses Cloudflare Access and Workers to secure its Programmable Banking platform and open banking APIs.

Does not prove: This is an application security and API case study, not a branch network, SD-WAN or Magic WAN deployment; it does not evidence trading connectivity, branch connectivity or resilience testing.

cloudflare.com · Checked 12 Sept 2026 · Supports: Identity and zero trust access, UK delivery

Cloudflare Trust Hub | Cloudflare

Named service:

Cloudflare platform

Standard or regulation:

ISO 27001, ISO 27701, PCI DSS, SOC 2 Type II

Regulatory regime:

Not stated

Cloudflare protects our customers and their users by complying with a wide range of important security certifications. Explore our posture around ISO 27001, ISO 27701, PCI DSS, SOC 2 Type II, and others.

Cloudflare's Trust Hub landing page lists the certifications it holds and links to detail pages, without naming individual products against each certification on this page.

Does not prove: A certification list without a named product or FS customer; supports Partial evidence only for regulatory columns on its own, superseded by the dedicated PCI DSS page for column 24.

cloudflare.com · Checked 12 Sept 2026 · Supports: PCI DSS alignment

Bank of Cyprus & Cloudflare | Customer Story

Named financial institution:

Bank of Cyprus

Named service:

Magic Transit, Network Firewall, Cloudflare Network Interconnect

Countries, regions:

Cyprus

Regulatory regime:

EU

Outcome:

Automatic DDoS mitigation in ~5 seconds; large-scale attacks blocked in 3 months without manual intervention

The peace of mind is priceless, and our experience with Cloudflare and Parsectix has contributed significantly to achieving that.

Bank of Cyprus, supervised directly by the European Central Bank, uses Magic Transit, Network Firewall and Cloudflare Network Interconnect to mitigate DDoS attacks automatically and maintain service continuity.

Does not prove: Evidences network interconnect and DDoS resilience, not SD-WAN branch connectivity, trading connectivity, segmentation or RTO/RPO-style disaster recovery testing.

cloudflare.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Resilience and tested recovery

PCI DSS 4.0 FAQs | Cloudflare

Named service:

Cloudflare (Application Security, Application Performance, Zero Trust Services, Network Services, Developer Platform)

Standard or regulation:

PCI DSS 4.0

Regulatory regime:

Not stated

Cloudflare maintains PCI DSS Level 1 compliance for certain products

Cloudflare documents PCI DSS Level 1 compliance, audited annually since 2014, and lists Zero Trust Services (Access, Gateway, Tunnel), Network Services (WAN, Magic Transit, Network Firewall) and other product groups as in scope.

Does not prove: Confirms PCI DSS scope for named product categories but does not describe cardholder data environment segmentation and does not name an FS customer using it.

cloudflare.com · Checked 12 Sept 2026 · Supports: PCI DSS alignment

Magic WAN | Any-to-any connectivity | Cloudflare

Named service:

Cloudflare WAN (Magic WAN)

Regulatory regime:

Not stated

Facilitate site-to-site connectivity across network locations like branch offices, retail locations, and factory floors with Cloudflare WAN connectors.

Cloudflare's Magic WAN (SD-WAN) product page describes branch site-to-site connectivity and hybrid/multi-cloud routing, listing named customers such as RATP, Japan Airlines and JetBlue but no financial services customer.

Does not prove: No named financial institution uses Magic WAN on this page, so it is Partial-strength generic product evidence only, not proof of an FS deployment.

cloudflare.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Branch and office connectivity

UK Operational Resilience FAQs | Cloudflare

Named service:

Cloudflare's connectivity cloud platform

Countries, regions:

United Kingdom

Standard or regulation:

SS1/21, SS2/21, UK Critical Third Parties (CTP) regime

Regulatory regime:

UK

While Cloudflare, a technology provider, is not directly regulated by the PRA, Cloudflare designs its network and services with resilience, transparency, and security to help its customers meet their regulatory obligations.

Cloudflare's compliance page explains the FCA/PRA operational resilience regime (SS1/21, SS2/21) and the UK Critical Third Parties regime and states how Cloudflare's platform and contractual model relate to them.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Underlying content present but as three separate distinct sentences in FAQ, not as a single combined quote with ellipses.). Re-quote verbatim. Discusses the regime and Cloudflare's platform generically rather than naming Cloudflare One or Magic WAN specifically, and does not cite a named FS customer applying it. [2026-09-15] Re-quoted verbatim from live page.

cloudflare.com · Checked 15 Sept 2026 · Supports: UK regulatory alignment (FCA and PRA)

Cloudflare Data Localization Suite | Cloudflare

Named service:

Cloudflare Data Localization Suite (Customer Metadata Boundary, Keyless SSL, Geo Key Manager, Regional Services)

Regulatory regime:

Not stated

Keyless SSL and Geo Key Manager store private SSL keys in a user-specified region. / Customer Metadata Boundary ensures that logs do not leave the specified region.

Cloudflare's Data Localization Suite names specific products (Customer Metadata Boundary, Keyless SSL, Geo Key Manager) that keep logs and private keys within a chosen region, covering Zero Trust, Network Services and other product families.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Both clauses present individually as separate bullet points, in reverse order, not combined as one sentence.). Re-quote verbatim. Confirms the mechanism and named products but this page does not itself list which specific regions (UK, EU, US, Canada) are supported, directing readers to the Trust Hub instead. [2026-09-15] Re-quoted verbatim as two separate bullet points from the live page, matching the checker's finding.

cloudflare.com · Checked 15 Sept 2026 · Supports: Data residency and sovereignty, Encryption and key management

EU - Digital Operational Resilience Act (DORA) mapping

Named service:

Cloudflare Enterprise Subscription Services

Standard or regulation:

DORA (Article 30)

Regulatory regime:

EU

This document is designed to help Cloudflare customers who are a financial entity according to the EU Regulation 2022/2554 Digital Operational Resilience Act ("DORA")... to understand how Cloudflare's Enterprise Subscription Terms of Service ("ToS") and its appendices address the key contractual provisions stated under Article 30 of the DORA.

Cloudflare's DORA mapping document walks through Article 30(1)-(3) contractual requirements and matches them to its Enterprise Subscription Terms, SLA availability commitment, breach notification and annual business continuity framework maintenance.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Two related but separate sentences exist; combined quote omits 'of the breach' and post-incident assessment language, and business continuity sentence is separa). Re-quote verbatim. Maps the contract terms to DORA Article 30 but does not name Cloudflare One or Magic WAN specifically and is not tied to a named EU financial institution customer. [2026-09-15] Re-quoted verbatim from the live PDF's opening paragraph, which maps specific ToS sections clause-by-clause to Article 30 sub-provisions.

cf-assets.www.cloudflare.com · Checked 15 Sept 2026 · Supports: Incident notification support, EU DORA alignment

Enterprise Subscription Service Level Agreement | Cloudflare

Named service:

Cloudflare Enterprise Subscription

Regulatory regime:

Not stated

The Service will serve Customer Content globally 100% of the time.

Cloudflare's Enterprise SLA commits to 100% availability with service credits up to six months of fees, and sets P1 response times of under 1 hour for Premium Support and 30 minutes for Technical Account Management.

Does not prove: General enterprise contractual SLA, not specific to Magic WAN or Cloudflare One, and not tied to a named FS customer or a tested DR/RTO-RPO exercise.

cloudflare.com · Checked 12 Sept 2026 · Supports: Resilience and tested recovery, Incident notification support

Enabling log retention - Cloudflare Logs docs

Named service:

Cloudflare Logpull API

Regulatory regime:

Not stated

By default, your HTTP request logs are not retained.

Cloudflare documents that HTTP request log retention via Logpull must be explicitly enabled and is off by default, without stating a specific retention period on this page.

Does not prove: Explains the retention toggle mechanism only; it does not state a specific retention duration in days, so on its own it only Partially supports the logging/retention column.

developers.cloudflare.com · Checked 12 Sept 2026 · Supports: Logging, audit and evidence retention

Cloudflare Sub-Processors | Cloudflare

Named service:

Cloudflare services and professional services

Regulatory regime:

Not stated

Any sub-processor that processes our customers' personal data undergoes a thorough information security and privacy review process.

Cloudflare publishes separate sub-processor lists for its services and for professional services, and states each sub-processor undergoes a security and privacy review.

Does not prove: Confirms a published sub-processor list exists but this landing page does not itself show the list, a change-notification process, or customer audit rights, and is not FS-specific.

cloudflare.com · Checked 12 Sept 2026 · Supports: Concentration risk and subcontractor transparency

Cloudflare Data Processing Addendum | Cloudflare

Named service:

Cloudflare Services (Data Processing Addendum)

Regulatory regime:

Not stated

following termination or expiry of the Main Agreement or completion of the Service, at the choice of Customer, delete or return all Personal Data (including copies thereof) processed pursuant to this DPA

Cloudflare's DPA commits to deleting or returning customer personal data at the customer's choice on termination, and separately authorises Cloudflare Group entities and named categories of third parties to act as sub-processors.

Does not prove: Data return/deletion clause is contractual and generic across all customers, not FS-specific; sub-processor authorisation language does not describe FS-specific third-party or contractor access controls.

cloudflare.com · Checked 12 Sept 2026 · Supports: Third-party and outsourced access, Exit and portability

Moneybox | Case Study | Cloudflare

Named financial institution:

Moneybox

Named service:

Cloudflare Access, Cloudflare Zero Trust

Sites, branches, users:

300+ employees

Countries, regions:

United Kingdom

Regulatory regime:

UK

Outcome:

Least privilege access to applications they need to do their job

The Cloudflare Zero Trust platform delivers the high level of security required by a company operating in the financial services space.

Moneybox, a UK digital wealth management platform with over 750,000 customers, uses Cloudflare Access and Zero Trust to give its 300+ staff least-privilege remote access, moving all employees to secure remote work during the pandemic.

Does not prove: Covers workforce identity and remote access only; does not evidence branch connectivity, trading connectivity, segmentation or DR testing.

cloudflare.com · Checked 12 Sept 2026 · Supports: Identity and zero trust access, Remote and hybrid workforce, UK delivery

Luana Savings Bank & Cloudflare | Case Study

Named financial institution:

Luana Savings Bank

Named service:

Cloudflare Browser Isolation, Cloudflare Zero Trust

Sites, branches, users:

six branches, 100+ employees, approximately $2 billion in assets

Countries, regions:

United States (Iowa)

Regulatory regime:

US

Outcome:

Zero malware infections for seven years; 100% uptime with Cloudflare, up from 96% with the previous provider

Malicious code doesn't hit our computers. Browser Isolation is the quickest and easiest way we can deal with malware issues.

Luana Savings Bank, a $2 billion Iowa bank with six branches, uses Cloudflare Browser Isolation and Zero Trust, reporting zero malware infections for seven years and 100% uptime, up from 96% previously.

Does not prove: The six branches are named but Cloudflare's role is endpoint/browser isolation, not a branch network SD-WAN connectivity product, so it is not usable for the branch connectivity column.

cloudflare.com · Checked 12 Sept 2026 · Supports: Resilience and tested recovery, Identity and zero trust access, North America delivery

FIPS 140 level 3 compliance with Cloudflare Application Services

Named service:

Cloudflare Keyless SSL, Cloudflare Tunnel

Standard or regulation:

FIPS 140 Level 3

Regulatory regime:

Not stated

This document outlines a reference architecture for achieving Federal Information Processing Standard (FIPS) 140 Level 3 compliance using Cloudflare's Application Services.

Cloudflare's reference architecture shows how Keyless SSL and Tunnel can be combined with a customer-managed, third-party validated HSM (AWS CloudHSM, Azure Key Vault or Google Cloud KMS) so the private key never leaves the FIPS 140 Level 3 validated hardware.

Does not prove: The FIPS 140 Level 3 validation belongs to the third-party HSM, not to a Cloudflare-owned cryptographic module, so this is architecture guidance rather than a Cloudflare FIPS certification.

developers.cloudflare.com · Checked 12 Sept 2026 · Supports: Encryption and key management

Logs - Cloudflare One docs

Named service:

Cloudflare One

Regulatory regime:

Not stated

Cloudflare stores Zero Trust logs for different periods of time based on the service and plan type. Admin logs: 18 months (all plans).

Cloudflare One documentation states Gateway DNS, HTTP, Network and Access log retention ranges from 24 hours up to 180 days depending on plan (180 days on Enterprise), with Admin/audit logs retained for 18 months across all plans, and supports Logpush export.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Page phrasing is 'Cloudflare stores Zero Trust logs for different periods...' plus a table showing Admin logs = 18 months; not phrased as the quoted ellipsis se). Re-quote verbatim. Confirms named-product (Cloudflare One) retention periods and Logpush export, but is generic documentation, not tied to a named FS customer's actual retention configuration. [2026-09-15] Re-quoted verbatim from the live developer docs page and its retention table.

developers.cloudflare.com · Checked 15 Sept 2026 · Supports: Logging, audit and evidence retention

Cloudflare Data Loss Prevention (DLP) | Secure sensitive data | Cloudflare

Named service:

Cloudflare DLP, CASB (Cloudflare One)

Regulatory regime:

Not stated

works together with CASB to scan connected SaaS applications and cloud storage environments to identify exposed sensitive data at rest

Cloudflare's DLP product, part of the SASE/Zero Trust family, works with CASB to scan SaaS applications and outbound traffic for sensitive data such as PII, with no financial services context on this page.

Does not prove: Generic product capability page with no financial services customer or PCI/PII-specific compliance claim, so it only Partially supports the cloud and SaaS data controls column.

cloudflare.com · Checked 12 Sept 2026 · Supports: Cloud and SaaS data controls

NYC Government Financial Agency & Cloudflare | Customer Story | Cloudflare

Named service:

Cloudflare WAF, DDoS Protection

Sites, branches, users:

300,000+ community members served

Countries, regions:

United States

Regulatory regime:

US

Outcome:

Attack volume reduced by over 90% immediately; blocks approximately 500 million malicious requests monthly

Zero Trust is the only way to achieve a manageable level of security assurance.

An unnamed NYC government financial agency used Cloudflare WAF and DDoS protection to stop a credential-stuffing attack and is exploring Cloudflare Access and Cloudflare One Client.

Does not prove: The institution is anonymised (a public-sector agency, not a named financial institution), the case study is about web application attack mitigation, and Cloudflare One/Access adoption is only described as being explored, not implemented; not usable for any of the 28 columns.

cloudflare.com · Checked 12 Sept 2026

DORA compliance: Fortifying financial security and resilience with Cloudflare

Named service:

Cloudflare

Standard or regulation:

DORA

Regulatory regime:

Not stated

Mapping DORA requirements to Cloudflare capabilities - See how Cloudflare's solutions align with DORA's five key pillars and multitude of requirements.

A gated landing page promoting a DORA whitepaper; the substantive DORA-to-product mapping is contained in a separate downloadable PDF, not in the page content itself.

Does not prove: No specific product names, article references or facts are present on the page itself; the actual DORA mapping evidence comes from the separate PDF document, which is recorded as its own source row.

cloudflare.com · Checked 12 Sept 2026

theNET | Digital transformation in banking & financial services | Cloudflare

Named service:

Cloudflare connectivity cloud

Standard or regulation:

GDPR, PSD2

Regulatory regime:

Not stated

The Payment Services Directive (PSD2) are encouraging banks to adopt digital solutions

An industry thought-leadership article discussing threats to banks (citing breaches at TD Bank, Santander, DBS Bank and others as third-party incidents, not Cloudflare customers) and referencing GDPR and PSD2 generically.

Does not prove: The named institutions are breach examples unrelated to Cloudflare, not Cloudflare customers; no Cloudflare One, Magic WAN or Access product is named, so this cannot support any of the 28 columns.

cloudflare.com · Checked 12 Sept 2026

Cloudflare | The agile SASE platform (Cloudflare One SASE product page)

Named service:

Cloudflare One

Cloudflare empowers over 1,700 financial services organizations to deliver secure digital experiences while meeting data sovereignty, regulatory, and resiliency requirements.

Dedicated financial services industry page with a quantified customer count and named financial logos (Visa, SoFi, NCR Voyix, Stripe). The 1,700 figure is vendor self reported and unaudited. No SASE specific financial services case study was found; the named testimonial on the page is from Shopify, a commerce platform rather than a bank.

Does not prove: Tier 1 supplier page. Primary SASE positioning page named in the brief. Carries the 300+ cities SASE delivery claim, the single global per-seat pricing claim and a large customer logo wall. Logo wall carries no sector labels, so it supports named customers but not sector grading on its own. | New Source: https://www.cloudflare.com/solutions/financial-services

cloudflare.com · Checked 29 Jul 2026

Zscaler for Financial Services

Named service:

Zscaler Zero Trust Exchange

Countries, regions:

Multiple (customers named include UK, US, South Africa, India)

Regulatory regime:

Multiple

Compliance mandates like GDPR, PCI DSS, and SOX put friction on innovation

Zscaler's financial services industry page names Fannie Mae, Hastings Direct, Capitec and L&T Financial Services as customers and lists Zero Trust Exchange, ZIA, ZPA, Zero Trust Branch and other products, but gives no per-institution deployment detail on this page itself.

Does not prove: Generic industry page; does not itself prove any single capability with FS-specific detail beyond naming customers across UK, US, South Africa and India, which is used only as supporting evidence for global spread of named FS deployments.

zscaler.com · Checked 12 Sept 2026 · Supports: Global delivery

Hastings Direct Case Study | Customer Stories | Zscaler

Named financial institution:

Hastings Direct

Named service:

Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX)

Sites, branches, users:

3.9 million policyholders; 4,500 employees and outsource partners

Countries, regions:

United Kingdom (East Sussex)

Regulatory regime:

UK

Outcome:

2.5 billion transactions processed and 45 million policy violations prevented in a single quarter; 14,000+ threats blocked including 4,500 hidden in encrypted traffic

no matter when or where our colleagues choose to work

Hastings Direct, a UK insurer with 3.9 million policyholders, replaced legacy VPNs and proxies with ZIA, ZPA and ZDX, using ZPA to give users microsegmented access only to authorised resources.

Does not prove: Does not mention branch/office count, trading, PCI, DR/RTO-RPO testing, or any UK regulator (FCA/PRA) by name.

zscaler.com · Checked 12 Sept 2026 · Supports: Network segmentation and zoning, Remote and hybrid workforce, UK delivery

Fannie Mae Case Study | Customer Stories | Zscaler

Named financial institution:

Fannie Mae

Named service:

Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange

Sites, branches, users:

7,400+ US employees; 10,000 employees targeted for direct-to-internet access

Countries, regions:

United States

Regulatory regime:

US

Outcome:

Reduced IT complexity from 38 data replication models to 2; eliminated network backhauling with local internet breakouts

When you make that shift to Microsoft 365 while still backhauling everyone's traffic to HQ, the bandwidth usage goes through the roof.

Fannie Mae, described as part of the nation's critical financial infrastructure, used ZIA to give employees direct internet access to Microsoft 365 and is migrating security infrastructure toward AWS.

Does not prove: No RTO/RPO or tested DR outcome stated; no named US regulation (FFIEC, GLBA, NYDFS, SEC) referenced; segmentation and PCI not discussed.

zscaler.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, North America delivery

Capitec Bank Limited | Zscaler

Named financial institution:

Capitec Bank Limited

Named service:

Zscaler Zero Trust Exchange, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Zscaler Cloud Connector

Sites, branches, users:

17,000 users protected; 860 branches; 15,450 employees; 21 million bank customers

Countries, regions:

South Africa

Regulatory regime:

Multiple

Outcome:

744,758 security threats blocked and 125 million policy violations prevented annually; banking application migrated to AWS in 3 seconds with zero downtime

users are never placed on the corporate network, which reduces the attack surface

Capitec, South Africa's largest retail bank, used Zscaler Cloud Connector and ZPA/ZIA to migrate its banking application to AWS and to remove users from the corporate network as part of a zero trust rollout.

Does not prove: South Africa is outside the UK/North America scope of this evidence page so used only as global-delivery and general capability evidence, not for UK or NA delivery columns; no PCI or specific regulator named.

zscaler.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Network segmentation and zoning, Remote and hybrid workforce, Global delivery

Zscaler's Compliance Center

Named service:

Zscaler Zero Trust Exchange platform

Standard or regulation:

SOC 2 Type 2; ISO/IEC 27001; ISO/IEC 27018:2019; PCI DSS; FIPS 140-2; FIPS 140-3; CSA STAR Level 2

Regulatory regime:

Not stated

SOC 2 Type 2; SOC 3; ISO/IEC 27001; ISO/IEC 27018:2019; FIPS 140-2; FIPS 140-3; CSA STAR Level 2; PCI DSS

Zscaler's compliance portal lists certifications and attestations held by the company, including SOC 2, ISO 27001/27018, PCI DSS, FIPS 140-2/140-3 and CSA STAR, without stating which specific product each certificate scopes.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (All listed certifications individually confirmed on page but presented as separate list items/links, not as one semicolon-joined string.). Re-quote verbatim. Certificates are listed at company level without naming which service (ZIA/ZPA/Zero Trust Exchange) each attestation covers, and full certificate documents sit behind an authenticated portal not accessible here; not sufficient alone to prove PCI DSS AoC scope for a named service. [2026-09-15] Playwright fetch attempt 2026-09-15 was itself blocked by a Cloudflare bot-verification challenge ('Performing security verification') - this is not a script-rendering issue but active bot protection that a headless browser cannot pass. Manually opening this URL in a normal logged-in browser session is the only way to read it. [2026-09-14, Harry] Personally opened and confirmed live by Harry Yelland - the recorded wording matches the page/document exactly. This was previously unreachable by automation (bot-verification wall or unfetchable PDF).

compliance.zscaler.com · Checked 14 Sept 2026 · Supports: Encryption and key management, PCI DSS alignment

How Zscaler DSPM Helps Europe's Financial Sector Achieve DORA Compliance

Named service:

Zscaler DSPM

Countries, regions:

European Union

Standard or regulation:

DORA

Regulatory regime:

EU

DORA emphasizes the importance of reducing risks introduced by third-party ICT service providers. Zscaler DSPM amplifies transparency

A Zscaler blog post connects the Zscaler DSPM product to DORA's third-party ICT risk requirements, using a hypothetical EU financial institution rather than a named customer.

Does not prove: No named EU financial institution; the product discussed (DSPM) is a data security posture management add-on, not the core ZIA/ZPA/Zero Trust Exchange/Zero Trust SD-WAN service; does not cite specific DORA Article 30 contractual terms.

zscaler.com · Published 30 Jul 2025 · Checked 12 Sept 2026 · Supports: EU DORA alignment

Zscaler SLA Support | Service Level Agreement Documentation

Named service:

Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Zscaler Zero Trust Branch

Regulatory regime:

Not stated

99.999% of Customer's Transactions and Sessions during every month

Zscaler publishes SLA uptime commitments of 99.999% for ZIA, ZPA, ZDX and Zero Trust Branch, with tiered service credits and support response times ranging from 15 minutes to 48 hours depending on severity and plan.

Does not prove: This is an uptime/service-credit SLA, not a tested DR/failover outcome or RTO/RPO commitment, and it is not FS-specific; support response times are for support tickets, not security incident notification.

zscaler.com · Checked 12 Sept 2026 · Supports: Resilience and tested recovery

Zscaler Sub-Processors: Security & Privacy Standards

Named service:

Zscaler Zero Trust Exchange platform

Regulatory regime:

Not stated

On this page, we maintain a current list of Sub-Processors authorized to process Customer Data

Zscaler publishes a list of sub-processors including AWS, Azure, Google Cloud, Snowflake and Databricks, states it performs due diligence on them, and allows customers to register for change notices and to object to new sub-processors.

Does not prove: Generic company-wide sub-processor disclosure, not FS-specific; no explicit audit-rights clause quoted; does not name concentration-risk or multi-region independence statements beyond the sub-processor list itself.

zscaler.com · Checked 12 Sept 2026 · Supports: Concentration risk and subcontractor transparency, Third-party and outsourced access

Understanding Digital Sovereignty in the Modern Era

Named service:

Zscaler Zero Trust Exchange

Countries, regions:

United States, European Union, and other regions via Private Service Edges

Standard or regulation:

FedRAMP

Regulatory regime:

Multiple

pseudonymized local logging through public hub sites for regional or in-country requirements

Zscaler describes over 160 global data centres, a FedRAMP-authorised US GovCloud, an EU ZSCloud, and options for pseudonymised local logging, private on-premises logging infrastructure and sovereign sites, plus a 90-day emergency disconnect from the global cloud.

Does not prove: Does not explicitly name UK or Canada data residency regions; not FS-specific; describes architecture options rather than a guaranteed default residency for all customer log and management-plane data.

zscaler.com · Published 1 Jul 2025 · Checked 12 Sept 2026 · Supports: Data residency and sovereignty

Zscaler Security Cloud Receives FIPS 140-2 Validation for Encryption

Named service:

Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA)

Standard or regulation:

FIPS 140-2

Regulatory regime:

Not stated

Zscaler, Inc. (NASDAQ: ZS), an industry leader in cloud security, is proud to announce the immediate availability of FIPS 140-2 validated encryption within Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA).

Zscaler announced FIPS 140-2 validated encryption modules (Zscaler Mobile Cryptographic Module, certificate #3154, and Zscaler Crypto Module, certificate #3159) for ZIA and ZPA.

Does not prove: Press release is from 2018; does not confirm current FIPS 140-3 status of the present-day service, and is not FS-specific.

ir.zscaler.com · Published 11 Apr 2018 · Checked 12 Sept 2026 · Supports: Encryption and key management

SASE Solutions for PCI DSS 4.0 Compliance & Enhanced Security

Named service:

Zscaler Private Access (ZTNA)

Standard or regulation:

PCI DSS 4.0

Regulatory regime:

Not stated

With Zero Trust Network Access (ZTNA), Zscaler enforces least-privileged access and isolates payment systems from other business applications, minimizing unauthorized access.

Zscaler's PCI DSS 4.0 page states that its ZTNA capability isolates payment systems from other business applications, but does not reference a PCI DSS Attestation of Compliance for a named service or cite a customer.

Does not prove: No named financial institution or PCI scope reduction outcome; no Attestation of Compliance referenced for ZIA/ZPA/Zero Trust Exchange; generic marketing-style compliance page.

zscaler.com · Checked 12 Sept 2026 · Supports: Payment and cardholder data segmentation

OneMain Financial Case Study | Customer Stories | Zscaler

Named financial institution:

OneMain Financial

Named service:

Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange, Zscaler Client Connector

Sites, branches, users:

8,000+ employees across 1,400 branches in 44 states

Countries, regions:

United States

Regulatory regime:

US

Outcome:

96% of traffic experiences under 1ms latency with zero employee complaints post-migration; full SSL inspection of 96% of encrypted traffic

Using Zscaler now gives us the capability to route things directly out through the internet in our branches and campus location.

OneMain Financial, a US consumer lender with 1,400 branches across 44 states, replaced Broadcom/Blue Coat proxy appliances with ZIA to give branch and campus locations direct internet breakout and centralised policy administration.

Does not prove: No PCI, segmentation detail, RTO/RPO, or US regulator (FFIEC, GLBA, NYDFS, SEC) named on this page.

zscaler.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Branch and office connectivity, Remote and hybrid workforce, North America delivery

ABANCA Case Study | Customer Stories | Zscaler

Named financial institution:

ABANCA

Named service:

Zscaler Digital Experience (ZDX), Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange

Sites, branches, users:

6,000+ employees

Countries, regions:

Spain and 11 countries

Regulatory regime:

EU

Outcome:

Comprehensive global visibility into network traffic patterns and stronger controls for mission-critical applications

Zscaler is clearly giving us an opportunity to model new capabilities and new architectures, while reducing complexity.

ABANCA, a Spanish bank operating in 11 countries, deployed ZDX, ZIA and Zero Trust Exchange for global network visibility and detection of application-specific risk.

Does not prove: No DORA, branch count, PCI, or segmentation detail stated on this page; EU DORA alignment is not mentioned despite ABANCA being an EU bank.

zscaler.com · Checked 12 Sept 2026 · Supports: Network visibility and reporting, Global delivery

Zscaler Nanolog Streaming Service data sheet

Named service:

Zscaler Nanolog Streaming Service (NSS)

Regulatory regime:

Not stated

Transmit logs from all users and locations to the SIEM in real time

The Nanolog Streaming Service data sheet describes real-time streaming of web and firewall logs to up to eight SIEM destinations with customer-chosen filters and formats, and refers to historical log analysis beyond six months, but does not state a fixed Zscaler-side log retention period.

Does not prove: No explicit fixed log retention period stated; log storage location is described as customer-determined rather than a documented Zscaler data residency commitment; not FS-specific.

zscaler.com · Checked 12 Sept 2026 · Supports: Logging, audit and evidence retention

Zero Trust SD-WAN | Zscaler

Named service:

Zscaler Zero Trust SD-WAN

Regulatory regime:

Not stated

Zscaler Zero Trust SD-WAN securely connects users, devices, and workloads across branches, data centers, and the cloud.

The Zero Trust SD-WAN product page describes generic branch connectivity, segmentation and dynamic path selection capabilities, citing real-estate, manufacturing and media customers, with no financial services customer named.

Does not prove: No financial institution named as a Zero Trust SD-WAN customer, so this page cannot support any of the 28 FS columns on its own; rejected as a standalone FS evidence source, retained only for background on the product.

zscaler.com · Checked 12 Sept 2026

Zscaler digital transformation for the banking sector

Named service:

Zscaler Zero Trust Exchange

Regulatory regime:

Multiple

We embraced security as a journey that ran in parallel with our exploration of our applications, data, and transaction processing.

Quote is attributed to Fannie Mae on the dedicated financial services page. Four named customers across three continents: Fannie Mae (US), Hastings Direct (UK insurance), Capitec (South Africa) and L&T Financial Services (India). A second banking landing page corroborates the same set. Regulatory frameworks named on the page include PCI DSS, SOX, NIST CSF and ISO 27001.

Does not prove: Supplier's own banking landing page, linked from the industries index. Corroborates the same four named financial services customers as source 4. | Confirmed - exact match [2026-09-15, flagged per Robert's check] Duplicate of FS-080's generic narrative for a different page - same limitation. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit. Rejected 2026-09-15 (final pass). Same generic transformation narrative as FS-080, reused on a different Zscaler page - no named institution, no specific technical claim tied to a capability column.

zscaler.com · Checked 15 Sept 2026

Securing Financial Services in the Cloud and AI Era

Named service:

Netskope One SASE

Standard or regulation:

DORA, GDPR, NIS 2, PCI

Regulatory regime:

Multiple

Outcome:

helping reduce the risk of a severe breach by up to 80%

Support regulatory compliance across DORA, GDPR, NIS 2, PCI, and many other important regulatory requirements and data privacy regulations

Netskope's financial services industry page states that its platform helps customers meet several named regulations including DORA and PCI, and claims three of the five largest Fortune 100 financial services companies use its SASE platform, without naming them.

Does not prove: Generic financial services industry page with no named financial institution; the DORA reference is a capability claim rather than a compliance statement, Article 30 contractual term or named EU customer case, so it does not establish full DORA alignment.

netskope.com · Checked 12 Sept 2026 · Supports: EU DORA alignment

Compliance | Netskope

Named service:

Netskope platform

Standard or regulation:

ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, SOC 2 Type 2, PCI DSS, FedRAMP High, CSA STAR

Regulatory regime:

Not stated

PCI DSS - global security standard for all entities that store, process, or transmit cardholder data

Netskope's compliance page lists corporate-wide certifications including ISO 27001, SOC 2 Type 2, PCI DSS, FedRAMP High and CSA STAR, and links to the Trust Portal for further documents.

Does not prove: Certification list is corporate-wide and not tied to a named financial services customer or to the SD-WAN/SASE Branch product specifically; does not itself demonstrate FCA/PRA, NYDFS, DORA or OSFI regime alignment; no data residency, FIPS, encryption or log retention detail was found on this page.

netskope.com · Checked 12 Sept 2026 · Supports: PCI DSS alignment

NewEdge Network | Netskope

Named service:

NewEdge Network

Countries, regions:

80+ regions, 220+ countries and territories

Regulatory regime:

Not stated

Outcome:

<10ms Industry-best traffic processing latency SLAs

"120+ data centers in 80+ regions globally - including Mainland China." / "Route Control: Automatically routes traffic in real time over optimal paths from NewEdge data centers to address micro-outages or congestion, maintaining service continuity and low latency - even during ISP issues, or 'black swan' events."

Netskope describes its NewEdge network as having over 120 full-compute data centres in more than 80 regions, with automatic failover (GSLB and Auto Failout) and dynamic routing to maintain performance during disruptions.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Both facts (120+ data centers/80+ regions incl. Mainland China; Dynamic Route control) present but in separate sections, not combined as quoted.). Re-quote verbatim. General network infrastructure page not tied to a named financial institution, so it does not prove resilience or tested recovery for an FS customer specifically; no RTO/RPO figures or DR test outcomes are given. [2026-09-15] Re-quoted verbatim from the current live NewEdge datasheet (2026-03 edition), as two separate sentences matching the checker's finding.

netskope.com · Checked 15 Sept 2026 · Supports: Resilience and tested recovery, Global delivery

Apex Group Case Study | Netskope

Named financial institution:

Apex Group

Named service:

Netskope One SSE (Next Gen Secure Web Gateway, CASB, DLP, Threat Protection), Netskope Private Access, Cloud Firewall, Advanced Analytics

Sites, branches, users:

13,000+ employees, 34 companies

Countries, regions:

42 countries and legal jurisdictions

Regulatory regime:

Multiple

Outcome:

Consolidated from 40+ point-solutions to 8 technologies; automated level-one tier of global Security Operations Center; project completed 3 months ahead of schedule

Netskope provides us with the tools and capabilities to securely embrace cloud technologies while maintaining control and compliance

Apex Group, a global financial services provider operating 34 companies across 42 countries, deployed Netskope SSE, Private Access (ZTNA), Cloud Firewall and Advanced Analytics to consolidate security tooling, automate tier-one SOC work and gain visibility into cloud usage and risk.

Does not prove: Case study demonstrates SSE, ZTNA and CASB/DLP use by a named FS group, not SD-WAN, branch, trading or data-centre connectivity; it does not name a specific regulation, and describes internal group-company access rather than third-party/contractor access or explicitly remote/hybrid working.

netskope.com · Checked 12 Sept 2026 · Supports: Third-party and outsourced access, Network visibility and reporting, Identity and zero trust access, Cloud and SaaS data controls, Remote and hybrid workforce, Managed operations and SOC

Secure SD-WAN | Netskope One SASE Branch | Netskope

Named service:

Netskope One SASE Branch (Secure SD-WAN)

Countries, regions:

75+ regions

Regulatory regime:

Not stated

Extend VRF-based segmentation across branches, data centers, and cloud

Netskope's SASE Branch (Secure SD-WAN) product page describes VRF-based segmentation, sub-second failover, active-active links and multi-cloud on-ramps to AWS, Azure and Google Cloud WAN.

Does not prove: Product capability page only; no named financial institution or FS material links these SD-WAN segmentation, resilience or cloud on-ramp features to an actual deployment.

netskope.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Network segmentation and zoning, Resilience and tested recovery

Data Transfer at Netskope | Netskope

Named service:

Netskope

Countries, regions:

United States, EU, UK, Australia, Saudi Arabia, Switzerland, Singapore

Regulatory regime:

Multiple

Customers' log transaction data are stored in the management plane designated by each customer. Currently, management planes are available in the United States, the EU, the UK, Australia, Saudi Arabia, Switzerland, and Singapore.

Netskope documents that customers can choose the management plane region for their log/transaction data, currently offered in the US, EU, UK, Australia, Saudi Arabia, Switzerland and Singapore, plus configurable country- and region-specific data processing zones for traffic in motion.

Does not prove: Documents residency options generically across the whole customer base, not for a named financial institution; Canada is not listed as a distinct management plane region (only a broader 'North America Zone' for traffic processing); does not cover end-user content data, which Netskope states it does not store.

netskope.com · Checked 12 Sept 2026 · Supports: Data residency and sovereignty, North America delivery, UK delivery

Netskope Compliance Center

Named service:

Netskope platform

Standard or regulation:

PCI DSS v4.0.1, DORA, SOC 2 Type 2, ISO/IEC 27001, FedRAMP High, CSA STAR Level 2

Regulatory regime:

Multiple

PCI DSS v4.0.1

Netskope's Compliance Center lists PCI DSS v4.0.1 among its achieved certifications and lists DORA among the compliance frameworks or mappings it makes available, alongside SOC 2 Type 2, ISO 27001, FedRAMP High and CSA STAR.

Does not prove: The underlying documents (including the DORA mapping) sit behind a gated 'Get access' portal that was not opened; the page confirms the certification and DORA framework mapping exist but not their detailed contractual or FS-specific content.

compliance.netskope.com · Checked 12 Sept 2026 · Supports: EU DORA alignment, PCI DSS alignment

PCI-DSS Cloud Compliance | Netskope

Named service:

Netskope CASB, DLP, Next Gen Secure Web Gateway, ZTNA

Standard or regulation:

PCI DSS

Regulatory regime:

Not stated

Apply DLP and/or encryption policies to ensure that data containing PCI does not get into the wrong hands.

Netskope's PCI-DSS solution page describes how CASB, DLP, secure web gateway and ZTNA can inspect and control content containing cardholder data and support audit visibility, citing a Fortune 500 retailer SOC analyst quote.

Does not prove: Generic solution page; no named cardholder data environment, no named financial institution, and no PCI DSS Attestation of Compliance is referenced on this specific page.

netskope.com · Checked 12 Sept 2026 · Supports: Payment and cardholder data segmentation

GLBA Cloud Compliance | Netskope

Named service:

Netskope CASB

Countries, regions:

United States

Standard or regulation:

GLBA

Regulatory regime:

US

GLBA has specific compliance requirements tied to security and confidentiality, privacy, and safeguards.

Netskope's GLBA solution page names the regulation and its CASB product together, with a supporting quote from the CIO of Dana Foundation about assessing cloud application risk.

Does not prove: The only customer quoted, Dana Foundation, is a non-profit foundation rather than a bank, insurer or other regulated financial institution; the page does not cite the GLBA Safeguards Rule by name or any FFIEC, NYDFS or SEC alignment.

netskope.com · Checked 12 Sept 2026 · Supports: US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)

Sub-processors | Netskope

Named service:

Netskope

Regulatory regime:

Not stated

This is our updated list of third-party Sub-processors. For additional queries, please contact the Netskope Privacy team

Netskope publishes a downloadable, dated sub-processor list (referenced as a September 2026 PDF) and invites customer queries to its privacy team.

Does not prove: Confirms the practice of publishing an updated sub-processor list, but the linked PDF itself, containing the named sub-processors and any multi-region independence statement, was not opened as part of this research.

netskope.com · Published 1 Sept 2026 · Checked 12 Sept 2026 · Supports: Concentration risk and subcontractor transparency

Netskope Technical Support

Named service:

Netskope

Regulatory regime:

Not stated

We are a global team and operate 24/7/365

Netskope states its support team operates 24/7/365, with Premium and Premium Plus paid tiers offering full 24/7 phone and on-call coverage above the basic business-hours tier.

Does not prove: Generic corporate support-tier page, not FS-specific; gives no RTO/RPO or incident notification timelines, and full 24/7 phone coverage requires a paid Premium or Premium Plus tier rather than being included by default.

netskope.com · Checked 12 Sept 2026 · Supports: Managed operations and SOC

Ascensus Case Study | Netskope

Named financial institution:

Ascensus

Named service:

Netskope CASB, DLP, Next Gen Secure Web Gateway

Sites, branches, users:

5,000+ employees; serves 15 million+ people

Countries, regions:

United States

Regulatory regime:

US

Outcome:

CASB configured and operational within one hour; SWG deployed within five minutes for rule setup

We can protect our data and applications without ever just telling users 'no.'

Ascensus, a US-based retirement, education and healthcare savings recordkeeping and third-party administration provider serving over 15 million people, deployed Netskope CASB, DLP and NG-SWG to gain visibility and control over more than 2,000 cloud applications.

Does not prove: Case study covers cloud application visibility and DLP after a Microsoft 365 migration; it does not mention GLBA, FFIEC, SEC or any other specific financial regulation, and does not cover branch, SD-WAN, trading or data-centre connectivity.

netskope.com · Checked 12 Sept 2026 · Supports: Network visibility and reporting, Cloud and SaaS data controls, North America delivery

Netskope for DORA Compliance

Named service:

Netskope One (unified SASE platform)

Standard or regulation:

DORA - dedicated compliance guide mapping DORA's requirements to the Netskope One platform

Regulatory regime:

EU

"We've summarised and mapped the 79 pages of DORA to our industry leading platform to save you time... helps these organisations follow DORA's rules, applying zero trust principles to protect data and defend against cyber threats."

Netskope's own dedicated DORA compliance guide, verified live 2026-09-15. This is a genuine mapping document (not just a passing mention), addressing incident management, classification and reporting under DORA specifically - stronger than a blog aside, but it doesn't name Netskope One's Article 30 contractual terms specifically or a named EU financial customer, so graded Partial rather than Proven.

Does not prove: Added 2026-09-15 per item 6 (thin regulatory columns) research pass. A genuine compliance-mapping resource, not a certification list, but stops short of the Article 30 contractual-terms bar for Proven.

netskope.com · Checked 15 Sept 2026 · Supports: EU DORA alignment

Fortune 500 Financial Services Company Meets NYDFS Cybersecurity Regulations (Netskope + Unisys)

Named financial institution:

Not named ("a Fortune 500 financial services company")

Named service:

Netskope CASB

Countries, regions:

United States (New York)

Standard or regulation:

NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

Regulatory regime:

US

"When taking a look at how to achieve NYDFS security compliance, you need to look at CASB solutions."

Netskope's own blog post, verified live 2026-09-15, co-authored with partner Unisys, explicitly addressing NYDFS compliance via Netskope CASB. The customer is anonymised ('a Fortune 500 financial services company'), so this cannot support a named-customer Proven claim, but per the Regulations tab's own evidence bar ('provider material mapping the service to Part 500 sections'), this is genuine provider material connecting Netskope's product to NYDFS - graded Partial given the mapping is general rather than section-by-section.

Does not prove: Added 2026-09-15 per item 6 research pass. Anonymised customer; general NYDFS/CASB framing rather than a detailed Part 500 section mapping.

netskope.com · Checked 15 Sept 2026 · Supports: US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)

Maintain Compliance | Netskope

Named service:

Netskope One SSE, DLP, Advanced Analytics

Standard or regulation:

PCI-DSS, HIPAA, GDPR

Regulatory regime:

Not stated

Outcome:

Stronger compliance across global operations. Seamless M&A integration, improving operational consistency.

Stronger compliance across global operations. Seamless M&A integration, improving operational consistency.

Netskope's compliance solutions page cites an anonymised financial services customer using SSE, DLP and Advanced Analytics for compliance and M&A integration, alongside a claim of 40+ pre-configured compliance templates.

Does not prove: Customer is anonymised as 'financial services' with no name given, so under the grading rules it cannot support a Proven status for any column; kept only as background context, not cited in any status.

netskope.com · Checked 12 Sept 2026

Trust Portal

Named service:

Netskope Trust Portal

Regulatory regime:

Not stated

You need to enable JavaScript to run this app

Netskope's Trust Portal is a JavaScript application; the fetch tool could only retrieve the page shell and metadata, not the actual real-time or historical trust/performance content.

Does not prove: No compliance, uptime or performance content was retrievable; cannot be used as evidence for any column despite being the provider's named trust portal.

trust.netskope.com · Checked 12 Sept 2026

BDO Case Study | Netskope

Named service:

Netskope One CASB, Private Access, NG-SWG, NewEdge

Sites, branches, users:

8,000+ employees

Countries, regions:

Global

Regulatory regime:

Not stated

Outcome:

Network availability improved from 98.5% to 99.9%

We can control the data that our applications are accessing. Granularity and visibility are the real benefits.

BDO, the world's fifth-largest accountancy, consultancy and assurance firm, deployed Netskope CASB, Private Access and NG-SWG to replace legacy VPN and improve network availability.

Does not prove: BDO is an accounting and professional services firm, not a bank, insurer, payments or asset management company, so it does not qualify as a named financial institution under this brief despite quantified outcomes.

netskope.com · Checked 12 Sept 2026

Netskope Investor Relations

More than 4,000 customers, including three of the five largest financial services companies on the Fortune 100, trust our unified secure access service edge (SASE) platform, Netskope One.

The best evidenced sector by a clear margin. Four named customer stories on the industry page (Apex Group, JLL, RSM Australia, Ascensus), plus BMO and The Auto Club Group as logos, plus explicit DORA, GDPR, NIS 2 and PCI references. The Fortune 100 claim is a vendor claim and is not independently verified here.

Does not prove: Investor relations site of a NASDAQ listed company (NTSK). Statements here carry securities law accountability, so the Fortune 100 customer claim is more reliable than ordinary marketing copy. | Not found on page

investors.netskope.com · Checked 29 Jul 2026

Barracuda Trust Centre - Certifications page

Named service:

Barracuda (company-wide)

Standard or regulation:

SOC 2; ISO 27001; PCI DSS; FIPS

Regulatory regime:

Not stated

PCI DSS (SAQ-D attestation in progress)

Barracuda lists PCI DSS SAQ-D attestation as an in-progress certification for the company generally; it is not shown as achieved and is not tied to SecureEdge or CloudGen Firewall by name.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Page text reads 'PCI DSS (SAQ-D attestation in progress)' - quote omitted 'in progress' qualifier). Re-quote verbatim. This is a company-wide certification list, not product-specific to SecureEdge or CloudGen Firewall, and PCI DSS is listed as in-progress rather than achieved. Does not prove an AoC for the named service. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note.

· Published 10 Jun 2026 · Checked 15 Sept 2026 · Supports: PCI DSS alignment

Data Center Locations - Barracuda Trust Center

Named service:

Barracuda SecureEdge

Countries, regions:

UK, EU (multiple), US, Canada, and other global regions

Regulatory regime:

Multiple

West Europe (westeurope); Austria East (austriaeast); Germany West Central (germanywestcentral); France Central (francecentral)

Barracuda's data centre locator names SecureEdge specifically against a list of Azure/AWS regions that includes UK South, Canada Central and US regions alongside multiple EU regions.

Does not prove: Confirms hosting regions for SecureEdge but does not name a UK, US or Canadian financial services customer, and does not state which customer data types map to which region.

trust.barracuda.com · Checked 12 Sept 2026 · Supports: Data residency and sovereignty, North America delivery, Global delivery, UK delivery

Security - Barracuda Trust Center

Named service:

Barracuda (all products)

Regulatory regime:

Not stated

Barracuda will promptly (1) notify the relevant Customer of the Security Incident; (2) investigate the Security Incident; and (3) take reasonable steps to contain and mitigate the effects of the Security Incident.

Barracuda commits to promptly notify, investigate and mitigate security incidents, but does not state a specific notification timeframe such as a number of hours or days.

Does not prove: No defined timeframe (only 'promptly'), and the commitment is company-wide rather than SecureEdge-specific.

trust.barracuda.com · Checked 12 Sept 2026 · Supports: Incident notification support

Zero Trust Network Access Solution & Security Platform | Barracuda Networks

Named service:

Barracuda SecureEdge Access

Regulatory regime:

Not stated

SecureEdge Access supports SSO with access credentials from Microsoft Entra ID, Google Workspace, Okta, Okta Workforce, OpenID Connect, any other SAML-compatible services, and even generic email code sign-on.

SecureEdge Access documents ZTNA with SSO/IdP integration (Entra ID, Okta, Google Workspace, SAML) and SCIM provisioning, and describes remote access to applications from any client without bandwidth limits.

Does not prove: General product documentation, not financial-services specific; no named financial customer or FS-specific remote-workforce outcome.

barracuda.com · Checked 12 Sept 2026 · Supports: Identity and zero trust access, Remote and hybrid workforce

PCI DSS Compliance with Barracuda CloudGen Firewall

Named service:

Barracuda CloudGen Firewall

Standard or regulation:

PCI DSS 3.2.1

Regulatory regime:

Not stated

Barracuda CloudGen Firewall can help your organization satisfy every specific requirement of PCI DSS compliance version 3.2.1

Barracuda's own whitepaper explains how CloudGen Firewall can be used as a network segmentation gateway to isolate a cardholder data environment and to extend segmentation policy into AWS, Azure and Google Cloud, mapped against PCI DSS 3.2.1 requirements.

Does not prove: This is compliance-mapping guidance for customers to achieve PCI DSS themselves, not a PCI DSS Attestation of Compliance or certification for the CloudGen Firewall service itself, and it names no financial institution.

assets.barracuda.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Payment and cardholder data segmentation, Network segmentation and zoning, PCI DSS alignment

Barracuda SecureEdge: Features | Barracuda Networks

Named service:

Barracuda SecureEdge

Regulatory regime:

Not stated

Set role and attribute-based controls to grant contextual access to trusted users and devices

SecureEdge documents role- and attribute-based access controls and a dashboard for monitoring users, threats and infrastructure status, but does not describe CASB, DLP, SOC or a formal change-management/audit process.

Does not prove: No financial services context; RBAC is documented but a full change-control/configuration-audit process is not described on this page.

barracuda.com · Checked 12 Sept 2026 · Supports: Change control and configuration governance, Network visibility and reporting

Product & Service Description - SecureEdge Appliances and SaaS Service

Named service:

Barracuda SecureEdge

Countries, regions:

US, EMEA (West Europe), plus additional PoPs across Europe, Middle East, Americas and APAC

Regulatory regime:

Multiple

Outcome:

99.5% monthly availability commitment for SecureEdge and the SecureEdge Manager

During a subscription period, Barracuda keeps data in the Service for 30 days

Barracuda's SecureEdge product and service description states a 99.5% monthly availability commitment, that log and configuration data is encrypted in transit and at rest, that data is retained for 30 days during the subscription and up to 30 days after termination for the customer to download, and that reporting data resides in named Azure regions (US East for US data, West Europe for EMEA and global manager data).

Does not prove: This is a general commercial terms document, not financial-services specific; it names no financial customer, no FIPS validation, and the 99.5% figure is an availability commitment rather than a tested RTO/RPO or DR test result.

assets.barracuda.com · Checked 12 Sept 2026 · Supports: Logging, audit and evidence retention, Resilience and tested recovery, Data residency and sovereignty, Encryption and key management, Exit and portability, Global delivery

Barracuda SecureEdge Access: Features | Barracuda Networks

Named service:

Barracuda SecureEdge Access

Regulatory regime:

Not stated

Integration with your existing Azure Active Directory

SecureEdge Access documents Azure Active Directory integration and role- and attribute-based access controls; no CASB, DLP, SOC or MFA-specific claims appear on this page.

Does not prove: No financial services context; MFA, CASB and DLP are not mentioned on this page.

barracuda.com · Checked 12 Sept 2026 · Supports: Identity and zero trust access

Supplier Information - Barracuda Trust Center

Named service:

Barracuda (all products)

Regulatory regime:

Not stated

Sub-Processors and Critical Vendors View online

Barracuda's trust centre links to a published sub-processors and critical vendors list.

Does not prove: Index page pointing to the actual sub-processor list; company-wide, not SecureEdge-specific.

trust.barracuda.com · Checked 12 Sept 2026 · Supports: Concentration risk and subcontractor transparency

Sub-Processors and Critical Vendors - Barracuda Trust Center

Named service:

Barracuda (all products)

Regulatory regime:

Not stated

The following colocation data centers provide physical and environmental security to the Barracuda infrastructure; they don't have logical access.

Barracuda publishes a named list of sub-processors and critical vendors (including AWS, Microsoft Azure, Equinix, Redcentric, CoreSite, Canada15Edge and others) and distinguishes colocation providers with no logical data access from data-processing vendors.

Does not prove: This is a company-wide sub-processor list, not filtered to SecureEdge specifically, and contains no explicit multi-region independence statement beyond the colocation distinction.

trust.barracuda.com · Checked 12 Sept 2026 · Supports: Concentration risk and subcontractor transparency

Barracuda Trust Center Product Guide

Named service:

Barracuda's DORA Article 30 Amendment (Trust Center product guide)

Standard or regulation:

DORA Article 30

Regulatory regime:

EU

Product guide lists a 'DORA Article 30 Amendment' as an available legal document, alongside a dedicated DORA compliance category.

Harry personally verified this live 2026-09-15. Confirms and strengthens the earlier finding (FS-107/FIN-107) of a named DORA Article 30 Amendment document, now located within Barracuda's structured product guide rather than just the Trust Center navigation. Still platform-wide rather than confirmed SecureEdge-specific, and the amendment's actual terms were not read, so kept at Partial.

Does not prove: Added 2026-09-15, Harry-verified. Corroborates and locates precisely the DORA Article 30 Amendment already noted for Barracuda earlier in this project.

trust.barracuda.com · Checked 15 Sept 2026 · Supports: EU DORA alignment

Financial Services Cybersecurity: Cybersecurity in Financial Sector | Barracuda Networks

Named service:

Barracuda (general)

Regulatory regime:

Not stated

Financial services are a prime target for cyber attacks. Learn how Barracuda can help.

The page is a generic financial services landing page that links to SecureEdge, CloudGen Firewall and SD-WAN in navigation menus but does not discuss them or name any customer, regulation or capability on the page itself.

Does not prove: No named customer, no named regulation, no discussion of SecureEdge/CloudGen/SD-WAN capabilities on the page itself; only navigation links. Does not support any column.

barracuda.com · Checked 12 Sept 2026

Trust Center | Barracuda Networks

Named service:

Barracuda (all products)

Regulatory regime:

Not stated

Barracuda cloud-based SaaS offerings, and associated customer data (if applicable), are available in the Data center locator

This is an index page pointing to separate data residency, privacy, incident notification and sub-processor pages, which were opened and cited individually.

Does not prove: Index/navigation page only; no product-specific or capability-specific facts of its own beyond links, so the specific subpages are cited instead.

trust.barracuda.com · Checked 12 Sept 2026

SASE Platform & Cloud-First SASE Solution | Barracuda SecureEdge | Barracuda Networks

Named service:

Barracuda SecureEdge

Regulatory regime:

Not stated

SASE is an integrated service that provides comprehensive secure access for modern computing environments, reduces complexity and costs

General marketing description of SecureEdge as a SASE platform covering SD-WAN, ZTNA and Firewall-as-a-Service, with no customer names or measurable claims.

Does not prove: Generic marketing content only; no financial services context, no named customer, no specific figures.

barracuda.com · Checked 12 Sept 2026

SecureEdge Logs | Barracuda Campus

Named service:

Barracuda SecureEdge

Regulatory regime:

Not stated

Not applicable - page describes log types and filtering only

This product documentation page describes the types of logs available in SecureEdge and how to filter them, but does not state a retention period or SIEM export detail.

Does not prove: Does not state retention period or SIEM export; the retention fact was instead found in the Product and Service Description document.

documentation.campus.barracuda.com · Checked 12 Sept 2026

Barracuda SecureEdge - Specifications

Named service:

Barracuda SecureEdge

Regulatory regime:

Not stated

For information on mandatory and optional service/feature subscription, see SecureEdge Licensing documentation

This datasheet covers hardware form factors, throughput and physical specifications for SecureEdge appliances; it does not cover SLA, encryption, MFA, CASB, DLP, SOC or reporting.

Does not prove: Hardware specification sheet only; no SLA, security control or compliance detail relevant to any of the 28 columns.

assets.barracuda.com · Checked 12 Sept 2026

Barracuda SecureEdge: Resources | Barracuda Networks

Named service:

Barracuda SecureEdge

Regulatory regime:

Not stated

Not applicable - resource hub with filters only, no case studies rendered in fetched content

This is a filterable resource hub for SecureEdge; no individual case studies, and no financial services or named customer content, were present in the fetched page content.

Does not prove: No case study content retrievable from this page; searches for named financial institution case studies using SecureEdge or CloudGen Firewall found none.

barracuda.com · Checked 12 Sept 2026

Calypso Technology SD-WAN Case Study

Named financial institution:

Calypso Technology

Named service:

Aryaka SmartServices

Sites, branches, users:

20+ global sites; 35,000 users in 60+ countries; 800+ employees managed by IT

Countries, regions:

18 countries (offices); 60+ countries (users)

Regulatory regime:

Not stated

Outcome:

100% 24/7 availability, reliable network performance and reduced WAN management overhead for a lean IT team

"The saving grace of Aryaka is that it allows us to manage the WAN and our IT with such a lean staff." - Russell Wong, Global Director - IT, Calypso Technology

Calypso Technology, a global financial software company, deployed Aryaka SmartServices to connect more than 20 offices in 18 countries serving over 35,000 users, achieving 100% 24/7 availability and letting a lean IT team rely on Aryaka's proactive monitoring and support.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (PDF loaded ok; near-exact match but actual wording is 'Seeing an alert before I go to bed at night and knowing that Aryaka is already diving into it, so that wh). Re-quote verbatim. No publication date is shown; does not mention trading-floor latency, PCI or cardholder data, network segmentation, encryption specifics, or any named regulatory regime; the SmartServices branding reflects Aryaka's legacy product naming. [2026-09-15] Re-quoted 2026-09-15 from the live webpage version of this case study (aryaka.com/?p=26019) rather than the original PDF URL, which could not be re-fetched directly - content matches (same customer, same Russell Wong quote source), so treated as equivalent.

aryaka.com · Checked 15 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Network visibility and reporting, Branch and office connectivity, Resilience and tested recovery, Remote and hybrid workforce, Managed operations and SOC, Global delivery

Global Financial Leader Calypso Technology Trades Up to Aryaka for WAN Optimization

Named financial institution:

Calypso Technology

Named service:

WAN Optimization as-a-Service, Network as-a-Service, Application Delivery as-a-Service

Sites, branches, users:

Distributed teams and remote employees around the world

Countries, regions:

Global (specific countries not stated)

Regulatory regime:

Not stated

Outcome:

SCP over SSH ran 20 times faster; SVN source-code checkout ran 13 times faster; deployment completed in hours; bandwidth burst to 140% of subscribed levels

SCP over SSH runs 20X faster over Aryaka. SVN source-code checkout runs 13X faster.

A 2013 wire press release states that Calypso Technology, described as a global financial and software services company serving banks, prime brokers and buy-side firms, adopted Aryaka's WAN optimization, network and application delivery as-a-service for distributed teams and remote employees.

Does not prove: Dated 2013, predates Aryaka's current SD-WAN/SASE branding; does not mention trading-floor latency, PCI, segmentation, or any regulatory regime; Calypso is a financial software vendor to banks rather than a bank itself.

globenewswire.com · Published 11 Mar 2013 · Checked 12 Sept 2026 · Supports: Branch and office connectivity, Remote and hybrid workforce

Aryaka Service Level Agreement: Definitions And Details

Named service:

Aryaka PrivateCore, L3EnhancedCore, ANAP High Availability, SmartCDN, Hosted Firewall

Regulatory regime:

Not stated

Outcome:

99.999% uptime for PrivateCore services; ANAP failover in under 5 minutes; Tunnel Down notification within 30 minutes

Failover to the Standby ANAP in less than 5 minutes

Aryaka's published SLA commits to failover from a primary to standby ANAP appliance in under five minutes, tunnel-down notification to customers within 30 minutes, and uptime targets of up to 99.999% for PrivateCore services, with service credits for missed targets.

Does not prove: Not specific to financial services customers; states contractual failover and notification timings but no RTO/RPO terminology or DR test evidence, and no named FS customer.

aryaka.com · Checked 12 Sept 2026 · Supports: Resilience and tested recovery, Incident notification support

FIPS Compliance Readiness For Federal Customers

Named service:

Aryaka security services

Standard or regulation:

FIPS 140-2 / FIPS 140-3

Regulatory regime:

Not stated

Aryaka is not currently FIPS 140-2 or 140-3 certified across the full product stack.

Aryaka states it is not currently FIPS 140-2 or 140-3 certified across its full product stack, but claims a FIPS-aligned posture using FIPS-validated cryptographic modules and restricted TLS 1.2/1.3 cipher suites, with formal certification under evaluation for federal and defence demand.

Does not prove: Confirms that formal FIPS validation is not in place; used only as a limitation on the encryption and key management column, not as positive proof of certification, and is not financial-services specific. [2026-09-15, capability assigned per Robert's check] This is DISCONFIRMING evidence: the source states Aryaka is NOT currently FIPS 140-2/140-3 certified across the full product stack. Accepted as an accurate absence-of-certification finding, not as support for a Proven/Partial claim - should not be used to justify any positive rating.

aryaka.com · Published 29 Sept 2025 · Checked 12 Sept 2026 · Supports: Encryption and key management

Security FAQs | Universal ZTNA, AI Secure & Next-Gen DLP | Aryaka

Named service:

Aryaka Universal ZTNA; Aryaka Next-Gen DLP

Standard or regulation:

GDPR; HIPAA; PCI (referenced generically for DLP audit packs)

Regulatory regime:

Not stated

Standards-based SAML with major IdPs (e.g., Okta, Entra ID, etc.); we inherit MFA/SSO and can apply step-up based on risk/posture.

Aryaka's security FAQ states that Universal ZTNA integrates with SAML identity providers such as Okta and Entra ID, inheriting MFA/SSO with risk-based step-up, and that Next-Gen DLP provides retention controls, RBAC and SIEM-exportable audit logs, with audit packs mapped to GDPR, HIPAA and PCI; it also notes that data residency options must be confirmed per customer region.

Does not prove: General FAQ content, not tied to a named financial services customer; the PCI reference is only that DLP audit packs are mapped to PCI, not a PCI DSS Attestation of Compliance for the service; data residency answer is vague rather than a firm regional commitment.

aryaka.com · Checked 12 Sept 2026 · Supports: Logging, audit and evidence retention, Data residency and sovereignty, Identity and zero trust access, Encryption and key management, Cloud and SaaS data controls, PCI DSS alignment

Privacy Policy - Aryaka

Named service:

Aryaka

Standard or regulation:

GDPR; CCPA/CPRA; VCDPA; CPA; CTDPA

Regulatory regime:

Not stated

Your Personal Information may be stored and processed in any country or region where we have facilities or engage service providers

Aryaka's privacy policy states personal information may be stored and processed in any country or region where Aryaka or its service providers have facilities, including the United States, and uses standard contractual clauses for EU/UK transfers, with retention tied to business need rather than a fixed period.

Does not prove: Shows that Aryaka does not commit to regional data residency for personal data by default; does not name a financial services customer or a specific management-plane residency guarantee for the UK, EU, US or Canada.

aryaka.com · Checked 12 Sept 2026 · Supports: Data residency and sovereignty

Financial Services Organisations Digital Transformation Paving Way To A Smarter, Digital Future, Find Cloud Industry Forum And Aryaka | Aryaka

Named service:

Aryaka Managed SD-WAN

Sites, branches, users:

Survey of 250 UK financial services IT/business decision makers (50+ employees, ~GBP 8m average IT procurement budget)

Countries, regions:

UK

Regulatory regime:

UK

Outcome:

52% of UK financial services firms lack confidence in meeting regulatory obligations; 58% say their cloud security posture needs improvement

"This research demonstrates that now is a crucial time for the UK's financial services sector to move to the cloud." - Ian McEwan, Senior Vice President of International Sales, Aryaka

A joint Aryaka and Cloud Industry Forum survey of 250 UK financial services IT and business decision makers found high cloud adoption alongside gaps in confidence around regulatory compliance and cloud security posture, with an Aryaka SVP commenting that cloud migration must not compromise security and regulatory requirements.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Page loaded; actual text reads 'how they achieve this is more relevant than ever and it is critical that the move to the cloud does not compromise security, reg). Re-quote verbatim. No named financial institution or deployment; general survey commentary rather than a connection of Aryaka's product to a specific FS regulatory outcome; does not name FCA, PRA or DORA. [2026-09-15] Re-quoted verbatim, live-verified. This is a Cloud Industry Forum/Aryaka survey of the UK FS sector generally, not a named institution or product deployment - correctly stays sector-context evidence, not named-customer proof.

aryaka.com · Checked 15 Sept 2026 · Supports: UK delivery

Aryaka Global Points-of-Presence (PoPs)

Named service:

Aryaka Unified SASE

Countries, regions:

US: Ashburn, Atlanta, Chicago, Dallas, Denver, Los Angeles, Miami, Newark, San Jose, Seattle; Canada: Toronto; UK: London; plus EMEA and APAC PoPs

Regulatory regime:

Not stated

fast and reliable cloud and SaaS access from any location in the world

Aryaka lists points of presence including ten US cities, Toronto in Canada, and London in the UK, alongside EMEA and APAC coverage, as part of its global network delivery footprint.

Does not prove: Confirms geographic PoP footprint only; does not name any financial services customer using these PoPs and does not describe UK-based support or a UK data centre beyond the London PoP.

aryaka.com · Checked 12 Sept 2026 · Supports: North America delivery, Global delivery, UK delivery

Aryaka High Availability: Resilient, Secure, And Seamless Connectivity

Named service:

Aryaka High Availability (ANAP)

Regulatory regime:

Not stated

Virtual ANAP Redundancy Protocol (VARP)

Aryaka's High Availability datasheet describes dual-ISP redundancy, active-active SMARTlink link usage and ANAP failover using VARP, without quantified RTO or RPO metrics.

Does not prove: No RTO/RPO figures, no DR test evidence, and no named financial services customer; a general architecture datasheet only.

aryaka.com · Checked 12 Sept 2026 · Supports: Resilience and tested recovery

Aryaka Trust Center | Powered by SafeBase

Named service:

Aryaka Unified SASE / SD-WAN

Standard or regulation:

SSAE-18 SOC 2 Type II; ISO 27001

SafeBase-hosted Trust Center describing Aryaka's security programme, customer-data protection, SSAE-18 SOC 2 Type II, ISO 27001, encrypted IPsec, and compliance/assurance documentation.

Harry personally verified this live 2026-09-15. A structured Trust Center exists with real certifications, but the landing page alone doesn't connect Aryaka's named service to a specific SLA-backed incident-notification commitment or a detailed subprocessor list with audit/objection rights - graded Partial pending the underlying documents themselves.

Does not prove: Added 2026-09-15, Harry-verified. Trust Center landing page only - underlying detailed documents not individually opened.

trustcenter.aryaka.com · Checked 15 Sept 2026 · Supports: Concentration risk and subcontractor transparency, Incident notification support

Resources | Aryaka SD-WAN & SASE

Financial Services Company Calypso

Graded yes on a named customer (Calypso, a capital markets software firm) presented by Aryaka explicitly as a financial services company, plus 'Banking/Financial Services' being one of only six labels in Aryaka's own published industry filter. Confidence is medium not high because the evidence is an undated video testimonial rather than a written case study, there is no dedicated financial services industry page to sit alongside manufacturing, transport and professional services, and no banking accreditation or regulatory framework was found.

Does not prove: Supplier's own resource library. Its 'By Industries' filter is the authoritative published list of the sectors Aryaka itself indexes: Manufacturing, Banking/Financial Services, Transportation & Logistics, Business Services, Energy, Retail. Useful as a negative check for the four sectors absent from it. | Confirmed - exact match [2026-09-15, capability assigned per Robert's check] Calypso resource listing page - same underlying customer as FIN-101; weak on its own, corroborative only.

aryaka.com · Checked 29 Jul 2026 · Supports: Branch and office connectivity

Financial Services Company Calypso On Aryaka's Customer Support

Financial Services Company Calypso

Graded yes on a named customer (Calypso, a capital markets software firm) presented by Aryaka explicitly as a financial services company, plus 'Banking/Financial Services' being one of only six labels in Aryaka's own published industry filter. Confidence is medium not high because the evidence is an undated video testimonial rather than a written case study, there is no dedicated financial services industry page to sit alongside manufacturing, transport and professional services, and no banking accreditation or regulatory framework was found.

Does not prove: Supplier's own customer video page. The only named financial services customer found. Undated video testimonial rather than a written case study, hence medium confidence. | Confirmed - exact match [2026-09-15, capability assigned per Robert's check] Support-specific angle on the same Calypso case.

aryaka.com · Checked 29 Jul 2026 · Supports: Managed operations and SOC

The Financial Case For Unified SASE As A Service: Cut Costs & Accelerate ROI | Aryaka

Named service:

Aryaka Unified SASE as a Service

Regulatory regime:

Not stated

Discover how Aryaka's Unified SASE helps enterprises cut costs, reduce CapEx, and boost ROI

This page is a general financial and ROI ebook about Unified SASE as a Service, not a case study naming a financial services sector customer.

Does not prove: Despite its URL and title referencing 'financial', this is a cost/ROI business case document, not evidence about the financial services industry or any named financial institution.

aryaka.com · Checked 12 Sept 2026

Aryaka Customer Case Studies: Real-World SD-WAN & SASE Success Stories

Named service:

Aryaka Unified SASE / SD-WAN

Regulatory regime:

Not stated

This URL, expected to be the Calypso case study, instead rendered as a general case studies listing page naming other customers (Thetford, Lauridsen Group, AL-KO, Albemarle, Hubbell) and no financial services company.

Does not prove: Content did not match the expected Calypso case study; no financial services evidence found on this specific URL, so it is not used as a source (the separate Calypso PDF was used instead).

aryaka.com · Checked 12 Sept 2026

See Why Customers Rank Aryaka #1 In SD-WAN On G2 Summer 2026

Named service:

Aryaka Unified SASE / SD-WAN

Financial Services Company Calypso

Graded yes on a named customer (Calypso, a capital markets software firm) presented by Aryaka explicitly as a financial services company, plus 'Banking/Financial Services' being one of only six labels in Aryaka's own published industry filter. Confidence is medium not high because the evidence is an undated video testimonial rather than a written case study, there is no dedicated financial services industry page to sit alongside manufacturing, transport and professional services, and no banking accreditation or regulatory framework was found.

Does not prove: Supplier's own review round-up page. Names Cathay, World Kinect, Hubbell, NVIDIA, Makino and Pilot, and states the industries customers span. Vendor-curated selection of third-party reviews, so treat the review scores as promotional. | New Source: https://www.aryaka.com/videos/financial-services-company-calypso-on-aryakas-customer-support/

aryaka.com · Checked 29 Jul 2026

Guardian Credit Union Improves Network Control & Security with Cato

Named financial institution:

Guardian Credit Union

Named service:

Cato SASE Platform (with SD-WAN)

Sites, branches, users:

20 sites across a dozen Alabama counties

Countries, regions:

United States (Alabama)

Regulatory regime:

US

Outcome:

Improved network visibility and control, reduced operational complexity, cloud traffic no longer backhauled to the datacentre

Guardian Credit Union, an Alabama-based credit union, had a private network connecting 20 sites across a dozen Alabama counties.

Guardian Credit Union, a US credit union with 20 sites across Alabama, replaced its private network with Cato's SASE platform for network visibility, control and remote worker support.

Does not prove: Does not address trading/low latency, DC or cloud on-ramp naming, cardholder data segmentation, PCI, or any regulatory regime; page last modified 2024-09-26 but no original publish date shown.

catonetworks.com · Checked 12 Sept 2026 · Supports: Network visibility and reporting, Branch and office connectivity, Remote and hybrid workforce

Cato SASE Cloud secures networking of Bank Avera locations and its mobile employees

Named financial institution:

Bank Avera

Named service:

Cato SASE Cloud (NGFW, SWG, anti-malware, IPS, Cato Sockets SD-WAN)

Sites, branches, users:

Twelve locations, around 45,000 customers

Countries, regions:

Switzerland (greater Zurich area)

Regulatory regime:

EU

Outcome:

Complexity was reduced, uptime increased and processes simplified; new users, bandwidth and locations can be easily integrated

Bank Avera, which has been rooted in the greater Zurich area since 1828, serves around 45,000 satisfied customers via a network of twelve locations.

Bank Avera, a Swiss regional bank with twelve locations, uses Cato SASE Cloud to secure branch connectivity and mobile/home-working employees on one platform.

Does not prove: Switzerland is not UK, EU (post-Brexit EU membership), US or Canada for the regulatory columns in this brief; no PCI, DORA, resilience metrics or cardholder data segmentation stated.

catonetworks.com · Published 25 Nov 2021 · Checked 12 Sept 2026 · Supports: Network segmentation and zoning, Branch and office connectivity, Remote and hybrid workforce

How MoonPay Stopped Blocking AI and Started Governing It

Named financial institution:

MoonPay

Named service:

Cato AI Security

Standard or regulation:

PCI Level 1; SOC 2 Type 2; ISO 27001/27018/27701

Regulatory regime:

Not stated

Outcome:

Network-layer monitoring of prompts and responses, blocking of sensitive data such as crypto wallet addresses from being sent to AI tools, and anonymising outbound data

I could secure the data coming into the computers. I could secure the data going out.

MoonPay, a crypto payments fintech, uses Cato AI Security to monitor and control AI tool usage and prevent sensitive data such as wallet addresses leaving the organisation.

Does not prove: Case is about AI governance/DLP only, not branch connectivity, SD-WAN, segmentation, resilience or any named regulatory regime; PCI/SOC2/ISO are cited as MoonPay's own certifications, not a Cato attestation for the named service.

catonetworks.com · Checked 12 Sept 2026 · Supports: Cloud and SaaS data controls, Remote and hybrid workforce

Security, Compliance and Privacy | Cato Networks

Named service:

Cato SASE Cloud Platform

Standard or regulation:

PCI-DSS Level 1; SOC 2; SOC 3; ISO/IEC 27001:2013; ISO/IEC 27017:2015; ISO/IEC 27018:2019; ISO/IEC 27701:2019; GDPR

Regulatory regime:

Not stated

Cato is PCI-DSS Level 1 certified

Cato Networks states it holds SOC 2, SOC 3, PCI-DSS Level 1, several ISO 27000-series certifications and is GDPR compliant, without naming individual financial customers.

Does not prove: General corporate certification list, does not name a financial customer or give FIPS, data residency, log retention or key management specifics; a certification list is not by itself Proven for regulatory-regime columns 20-23 per the grading rules.

catonetworks.com · Checked 12 Sept 2026 · Supports: Encryption and key management, PCI DSS alignment

SASE Sovereignty at Cato Networks

Named service:

Cato Management Application (CMA) / Cato SASE Cloud

Countries, regions:

US, EU, India, Japan (control plane); UK, Germany, Netherlands, Italy, France, Singapore, Australia, Philippines, Israel (regional legal entities)

Regulatory regime:

Multiple

Customer policy, configuration, and event data is anchored to the selected region and does not leave it

Cato documents regional Cato Management Application instances in the US, EU, India and Japan, with customer configuration and event data anchored to the chosen region, and lists regional legal entities including the UK, but does not list Canada.

Does not prove: No Canada region listed for the management/data plane; document does not name a financial customer using a specific region, and gives no encryption algorithm or key-management specifics beyond who holds keys in Private CMA deployments.

knowledge.catonetworks.com · Published 22 Jun 2026 · Checked 12 Sept 2026 · Supports: Data residency and sovereignty

Cato Networks Sub-Processors

Named service:

Cato SASE Cloud Platform

Regulatory regime:

Not stated

Cloud computing provider and data hosting

Cato publishes a named list of sub-processors covering general services, remote browser isolation, sandboxing and AI security services, including AWS, Datadog, Snowflake, Twilio, OpenAI and others, last updated 19 May 2026.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Page lists AWS as 'Cloud computing provider and data hosting' rather than exact quoted phrasing 'Cloud computing and data hosting'). Re-quote verbatim. List names sub-processors but contains no multi-region independence statement or audit-rights language, and is not specific to financial services customers. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note.

support.catonetworks.com · Published 19 May 2026 · Checked 15 Sept 2026 · Supports: Concentration risk and subcontractor transparency

Service Level Agreement

Named service:

Cato Cloud service

Regulatory regime:

Not stated

any instance that is Unavailable for more than six minutes of a clockhour

Cato's published SLA commits to at least 99.5 percent instance-level uptime with tiered service credits, but defines unavailability narrowly as loss of external connectivity and states no RTO, RPO or failover procedure.

Does not prove: No RTO/RPO or tested-failover commitment is stated; this is a generic commercial SLA, not a financial-services-specific resilience commitment, and does not name any FS customer.

cato.digital · Checked 12 Sept 2026 · Supports: Resilience and tested recovery

SASE for Credit Unions | Cato Networks

Named financial institution:

Guardian Credit Union

Named service:

Cato SASE Cloud

Countries, regions:

United States

Standard or regulation:

PCI-DSS; NCUA policies

Regulatory regime:

US

Outcome:

Cato SASE enables compliance policies to be configured in a few days via zero-touch deployment and self-service portals

Federally insured credit unions are required to report cyber security incidents within 72 hours.

Cato's credit union solution page states that credit unions must comply with PCI-DSS and NCUA rules, including a 72-hour cyber incident reporting requirement, and features Guardian Credit Union as its case study, but does not itself state that Cato's service carries a PCI DSS attestation.

Does not prove: States the regulatory requirement credit unions face, not that Cato's own service has a PCI DSS Attestation of Compliance or a specific incident-notification SLA to customers; no FFIEC or GLBA mention.

catonetworks.com · Checked 12 Sept 2026 · Supports: Payment and cardholder data segmentation, Incident notification support

Guide to Cato Data Lake

Named service:

Cato Data Lake

Regulatory regime:

Not stated

For contracts and renewals starting from January 1st, 2024, the default retention period for events is 3 months.

Cato documents a default 3-month event log retention period, with 6- and 12-month extended retention available for purchase, and free integrations to export logs to AWS S3, Azure Blob Storage or SIEM tools.

Does not prove: Retention and export are documented for the general Cato Cloud service, not specifically for a financial services customer; no audit-trail-specific retention statement is given.

knowledge.catonetworks.com · Published 24 Aug 2026 · Checked 12 Sept 2026 · Supports: Logging, audit and evidence retention

Universal ZTNA | Cato Networks

Named service:

Cato Universal ZTNA

Regulatory regime:

Not stated

Use your SSO/MFA or Cato's user database

Cato's ZTNA platform page documents identity- and context-based access control with SSO/MFA integration, applied uniformly across users, devices and locations.

Does not prove: Generic product documentation with no financial services customer or industry context named on this page.

catonetworks.com · Checked 12 Sept 2026 · Supports: Identity and zero trust access

Standard Insurance Uses Cato for Cloud Migration and Digital Transformation

Named financial institution:

Standard Insurance

Named service:

Cato SASE Platform (Cato Socket SD-WAN devices)

Sites, branches, users:

60 branches, 700+ dealer/agent networks, 1,500 associates

Countries, regions:

Philippines

Regulatory regime:

Not stated

Outcome:

Internet bandwidth increased 10x; branch deployment reduced to minutes; security costs reduced by half

allows our branches to easily connect to the AWS cloud via the Cato network

Standard Insurance, a Philippines-based insurer with 60 branches, uses Cato's SASE platform with Cato Sockets to connect branches and route traffic to AWS through Cato Points of Presence co-located with AWS IXPs.

Does not prove: Philippines is outside the UK/EU/US/Canada regulatory scope of this brief; no PCI, resilience testing or cardholder data segmentation stated.

catonetworks.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Network segmentation and zoning, Branch and office connectivity

FIPS Compliance and TLS Configuration at Cato Networks

Named service:

Cato Networks platform

Standard or regulation:

FIPS 140-2; FIPS 140-3

Regulatory regime:

Not stated

Cato Networks is not FIPS 140-2 or 140-3 certified

Cato's own support documentation confirms Cato Networks is not FIPS 140-2 or 140-3 certified, and instead documents how to configure TLS cipher suites that align with FIPS-approved algorithms as a workaround.

Does not prove: This page disproves FIPS validation rather than supporting any capability column; kept as a contradiction record only, not used to support column 10.

support.catonetworks.com · Published 24 Jun 2025 · Checked 12 Sept 2026

Customers filtered by Financial Services

Guardian Credit Union is a regional business that faced big network challenges.

Cato runs both a Financial Services and a separate Credit Union industry filter. Named customers found: Guardian Credit Union, Bank Avera and MoonPay, a crypto payments business. Conflict recorded and not resolved: the law firm Fidal is also filed under the Financial Services label on Cato's site, which inflates that filter, so the credit union and the bank are the cleaner evidence.

Does not prove: Supplier's own filtered case study listing. | New Source: https://www.catonetworks.com/customers/guardian-credit-union-improves-network-control-security-with-cato/

catonetworks.com · Checked 29 Jul 2026

Customers filtered by Credit Union

Guardian Credit Union is a regional business that faced big network challenges.

Cato runs both a Financial Services and a separate Credit Union industry filter. Named customers found: Guardian Credit Union, Bank Avera and MoonPay, a crypto payments business. Conflict recorded and not resolved: the law firm Fidal is also filed under the Financial Services label on Cato's site, which inflates that filter, so the credit union and the bank are the cleaner evidence.

Does not prove: Supplier's own filtered case study listing. | New Source: https://www.catonetworks.com/customers/guardian-credit-union-improves-network-control-security-with-cato/

catonetworks.com · Checked 29 Jul 2026

Automating and Simplifying the WAN for Financial Services IT

Named service:

Versa FlexVNF SD-WAN, Versa Director, Versa Analytics

Sites, branches, users:

1,000 branches, 50,000 employees worldwide

Countries, regions:

United States, expanding into new markets

Regulatory regime:

Not stated

Outcome:

25x bandwidth increase per branch, 4x improved reliability, 50% reduced maintenance costs, 9x faster time-to-service

single or dual low-speed (T1 – 6 Mbps) MPLS circuits with low-bandwidth LTE backup and no direct Internet access

An anonymised Fortune 500 financial services company with 1,000 branches and 50,000 employees and over $300 billion in assets deployed Versa FlexVNF SD-WAN and SD-Security to replace legacy MPLS links, citing micro-segmentation with separate control and data paths per segment.

Does not prove: Institution is anonymised, so this cannot be treated as a named financial institution; no regulatory regime named; no PCI or trading-specific detail.

versa-networks.com · Checked 12 Sept 2026 · Supports: Change control and configuration governance, Network visibility and reporting, Network segmentation and zoning, Branch and office connectivity

Global Financial Services Firm case study

Named service:

Versa Secure Cloud IP (SD-WAN Platform-as-a-Service)

Sites, branches, users:

Multiple branch offices across dozens of sites globally

Countries, regions:

Global

Regulatory regime:

Not stated

Outcome:

Shortened time-to-deploy and upgrade; improved WAN availability and efficiency

intelligent traffic steering to route around network problems, before users were affected.

An anonymised global financial services firm used Versa Secure Cloud IP with Dell uCPE hardware to segment retail and investment banking network traffic and improve resilience across a global branch footprint.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Exact phrase not found; PDF contains similar wording: 'intelligent traffic steering to route around network problems, before users were affected.'). Re-quote verbatim. Institution anonymised; no named country, no RTO/RPO figures, no trading floor or exchange connectivity explicitly named, only 'investment banking' segmentation mentioned. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note.

versa-networks.com · Checked 15 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Network segmentation and zoning, Resilience and tested recovery

Global Credit Card Payments Company Modernizes WAN

Named service:

Versa Networks SD-WAN

Regulatory regime:

Not stated

Outcome:

Eliminated hardware device sprawl; reduced Capex, power consumption and maintenance costs; shortened provisioning timeframes

Their business could no longer be constrained by physical infrastructure

An anonymised global payments and financial/commerce technology company used Versa SD-WAN and VNFs on commodity CPE to connect branch offices, processing centres, cloud resources and mobile/IoT endpoints.

Does not prove: Institution anonymised; no PCI DSS or cardholder data segmentation explicitly named in this document despite being a payments company; no site or user counts given.

versa-networks.com · Checked 12 Sept 2026 · Supports: Data-centre, colocation and cloud connectivity, Branch and office connectivity, Remote and hybrid workforce

PCI-DSS Compliance with Versa Secure SD-WAN

Named service:

Versa Secure SD-WAN

Standard or regulation:

PCI DSS

Regulatory regime:

Not stated

No cardholder data is stored on the system. The data is processed and forwarded to the destination instantaneously.

Versa's whitepaper maps Versa Secure SD-WAN capabilities (VLAN/VRF segmentation, per-tenant IPsec tunnels with AES-256, AAA/SAML integration, audit logging) to specific PCI DSS requirements including firewalling, encryption, access control and monitoring.

Does not prove: This is a generic capability-to-requirement mapping, not an Attestation of Compliance (AoC) or certification, and it does not name a customer; no PCI DSS version stated.

versa-networks.com · Checked 12 Sept 2026 · Supports: Payment and cardholder data segmentation, Logging, audit and evidence retention, Identity and zero trust access, Encryption and key management, PCI DSS alignment

Privacy Policy | Versa Networks

Named service:

Versa Networks (corporate)

Countries, regions:

Global

Regulatory regime:

Not stated

the Processing is necessary in connection with any contract that you may enter into with us

Versa's general corporate privacy policy describes personal data retention in generic terms with no specific retention period, and references Standard Contractual Clauses for international transfers with no named regional data residency options and no specific sub-processor list.

Does not prove: Checker 2026-09-12: page carries the fact but the wording differs (Page reads 'is necessary' instead of 'necessary' - near-identical wording but not an exact match.). Re-quote verbatim. This is a corporate website privacy policy, not a product-level data residency, log retention or sub-processor disclosure for the SD-WAN/SASE service itself; no specific retention period, region list or sub-processor names given. [2026-09-15, Playwright fetch] Re-quoted verbatim (corrects the missing 'is'). Confirmed this is the general corporate privacy policy, not a product-level data residency or retention disclosure for the SD-WAN/SASE service.

versa-networks.com · Checked 15 Sept 2026 · Supports: Logging, audit and evidence retention, Third-party and outsourced access, Data residency and sovereignty, Exit and portability

Versa introduces cloud-based sovereign solution for enterprises of all sizes

Named service:

Versa Sovereign SASE-as-a-Service

Countries, regions:

Germany, DACH region, EU

Regulatory regime:

EU

Data plane, control plane, management plane, and logging operating entirely on EU-hosted and controlled infrastructure, independent of Versa's global cloud infrastructure.

Independent trade press reports that Versa's Sovereign SASE-as-a-Service, contracted through Versa Networks B.V. in the Netherlands, keeps all data, control, management and logging planes on EU-hosted infrastructure, initially for the Germany/DACH region, and cites a Swisscom national-scale deployment.

Does not prove: Article does not name a financial services customer using this sovereign offering and does not state UK, US or Canadian regional equivalents; Swisscom is a telecom partner deployment, not a named FS end customer.

helpnetsecurity.com · Published 27 Feb 2026 · Checked 12 Sept 2026 · Supports: Data residency and sovereignty

Financial Services Solution | Versa Networks

Named service:

Secure SD-WAN, ZTNA, VersaONE

Countries, regions:

Global

Standard or regulation:

GDPR, CCPA, FINRA

Regulatory regime:

Multiple

they can support and secure diverse lines of service, such as IT, guest Wi-Fi, ATMs and mobile insurance agencies

Versa's financial services solution page describes generic industry use cases for Secure SD-WAN and ZTNA (branch expansion, cloud migration, mission-critical application access) and references GDPR, CCPA and FINRA as data privacy drivers, without naming any customer.

Does not prove: No named financial institution; regulatory mentions (GDPR, CCPA, FINRA) are generic industry context, not a compliance statement connecting the named service to a specific regime's rules; this is Partial-level evidence only.

versa-networks.com · Checked 12 Sept 2026 · Supports: Payment and cardholder data segmentation, Branch and office connectivity, Cloud and SaaS data controls, Remote and hybrid workforce

Financial Services, Powered by SD-WAN - The Versa Networks Blog

Named service:

SD-WAN

Regulatory regime:

Not stated

centralizes provisioning and management of the network, ensuring all locations are compliant with government regulations

A generic Versa blog post argues SD-WAN speeds up bank branch deployment and centralises regulatory-compliant network management, without naming any bank or specific regulation.

Does not prove: No named customer, no specific regulation identified, no trading, remote workforce or PCI detail; marketing-style generic claim only.

versa-networks.com · Checked 12 Sept 2026 · Supports: Change control and configuration governance, Branch and office connectivity

Service Level Agreement (Versa Hosted and Managed Secure Services Edge Gateways)

Named service:

Versa Hosted and Managed Secure Services Edge Gateways

Regulatory regime:

Not stated

Outcome:

99.999% monthly uptime target with tiered service credits for missed SLA

customer must notify Versa of the missed SLA Uptime Percentage by opening a support ticket...within [2] calendar days following the end of the applicable month

Versa's Hosted SASE SLA commits to a 99.999% monthly uptime target with tiered service credits for breaches, and sets a 2-calendar-day customer notification window to claim credits, plus latency targets of 10ms and 50ms for specific security functions.

Does not prove: This document defines the customer's obligation to notify Versa of an SLA breach to claim credit; it does not state Versa's own commitment to notify customers of a security incident, and gives no RTO/RPO figures.

versa-networks.com · Checked 12 Sept 2026 · Supports: Resilience and tested recovery, Incident notification support

Validating Investment in World-Class Information Security, Versa Extends Security and Privacy Controls with New and Renewed Industry Certifications

Named service:

VersaONE Universal SASE Platform

Standard or regulation:

ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, HIPAA

Regulatory regime:

Not stated

successfully achieved ISO/IEC 27001 recertification...and fully re-certified for the SOC 2...standards following extensive independent audits

Versa announced renewal of ISO 27001 (seventh year) plus ISO 27017/27018 cloud security and privacy controls, SOC 2 Type II re-certification and HIPAA re-certification for the VersaONE Universal SASE Platform, and lists FIPS 140-2, PCI DSS, Common Criteria, ISO 9001, ISO 14001, ISO 20000-1 and ISO 22301 among its other certifications.

Does not prove: Certifications are corporate/platform-level, not specific to any financial services customer or regime (FCA, NYDFS, OSFI, DORA); a certification alone does not satisfy the regulatory-alignment columns per the grading rules.

versa-networks.com · Published 30 Oct 2025 · Checked 12 Sept 2026 · Supports: Logging, audit and evidence retention, Data residency and sovereignty, Encryption and key management, Cloud and SaaS data controls

Versa Networks Achieves FIPS 140-2 Security Certification

Named service:

Versa Operating System (VOS)

Standard or regulation:

FIPS 140-2

Regulatory regime:

Not stated

FIPS-certified VOS cryptographic modules power the cryptography for the Control Plane and Data Plane of the Versa SASE and Versa Secure SD-WAN solutions.

Versa's press release states the Versa Operating System (VOS), the foundation of Versa SASE and Versa Secure SD-WAN, holds FIPS 140-2 Level-1 certification for both branch (certificate #4379) and controller (certificate #4380) roles.

Does not prove: FIPS 140-2 only; no FIPS 140-3 validation found for the current product line at time of research; not financial-services-specific.

businesswire.com · Published 5 Jan 2023 · Checked 12 Sept 2026 · Supports: Encryption and key management

Versa Networks Achieves Common Criteria EAL4+ Certification

Named service:

Versa Operating System (VOS)

Standard or regulation:

Common Criteria EAL4+

Regulatory regime:

Not stated

auditing, access control, encryption, identification and authentication, secure administration, tamper resistance, and trusted communication paths

Versa announced Common Criteria EAL4+ certification of the Versa Operating System (VOS), the foundation for Versa Unified SASE and Versa Secure SD-WAN, covering security functions, source code, development lifecycle and vulnerability management processes.

Does not prove: Corporate/product certification only; no financial services customer or regulator named.

versa-networks.com · Checked 12 Sept 2026 · Supports: Change control and configuration governance

What is DORA? Compliance & Digital Resilience Guide

Named service:

VersaONE Universal SASE, SD-WAN, SSE

Standard or regulation:

DORA

Regulatory regime:

EU

States VersaONE Universal SASE, SD-WAN, SSE and SASE products can help financial-services customers address DORA, while explicitly stating Versa itself is not directly subject to DORA.

Harry personally verified this live 2026-09-15. Versa's own blog explicitly disclaims being directly subject to DORA and frames the products as helping customers rather than being contractually DORA-aligned itself - graded Partial, matching the document's own caution not to upgrade this to Proven.

Does not prove: Added 2026-09-15, Harry-verified. Provider explicitly states it is not directly subject to DORA - this is product-marketing content, not a contractual mapping.

versa-networks.com · Checked 15 Sept 2026 · Supports: EU DORA alignment

A Smart Investment: RCBC Nets Big Dividends with Versa Secure SD-WAN

Named financial institution:

Rizal Commercial Banking Corporation (RCBC)

Named service:

Versa Secure SD-WAN

Sites, branches, users:

469-505 branches; 890-1,468 ATMs and ATM Go terminals across all 82 provinces of the Philippines

Countries, regions:

Philippines

Regulatory regime:

Not stated

Outcome:

Largest deployment of Versa Secure SD-WAN in the Philippines; simplified network management and strengthened security across the branch/ATM network

"We are dedicated to providing our customers with seamless and secure banking experiences, and the deployment of Versa Secure SD-WAN represents a critical milestone in our digital transformation journey." - Nilo Zantua, Senior Vice President, Chief Information Officer and Group Head, RCBC. RCBC is described as "one of the largest commercial banks in the Philippines, with over PHP1.3 trillion in total resources."

Versa's own case study PDF, verified live 2026-09-15, independently corroborated by Philippine business press (Manila Bulletin, Daily Tribune) covering the same September 2024 contract-signing event. RCBC is a real, major, named Philippine bank with a named C-level executive quote. This is meaningfully stronger evidence than Versa's existing anonymised 'Global Financial Services Firm' case studies. Regulatory regime not stated - Philippines is outside the UK/EU/US/Canada regimes tracked by this workbook (BSP - Bangko Sentral ng Pilipinas - is the relevant regulator but not named on the source itself).

Does not prove: Added 2026-09-15 per further research pass. No specific RTO/RPO or resilience test result stated - "strengthen network resiliency" is a stated goal, not a measured outcome.

versa-networks.com · Checked 15 Sept 2026 · Supports: Network segmentation and zoning, Branch and office connectivity, Resilience and tested recovery

Versa Networks - homepage (named customer quotes, VersaONE positioning)

A Fortune 500 financial services company chooses software defined WAN (SD-WAN) to transform their legacy architecture

Strongest sector evidence for this supplier. Two independent strands on the vendor's own site: a Fortune 500 financial services customer story on the homepage, and a Gartner Peer Insights review published on the customers page attributed to 'Network Engineer – Banking'. A dedicated page is also listed at https://versa-networks.com/solutions/industries/financial-services/ but could not be loaded. Neither customer is named.

Does not prove: Tier 1 supplier material. Read via https://r.jina.ai/https://versa-networks.com/ because of the same bot wall. Quotes re-extracted on three separate passes and matched each time. Customer stories are anonymised apart from Adobe. | Confirmed - exact match

· Published 16 Mar 2026 · Checked 29 Jul 2026 · Supports: Branch and office connectivity

Versa Security and Trust Center | Versa Networks

Named service:

Versa Security and Trust Center listings

Regulatory regime:

Not stated

SOC 2 Type II, SOC 3, ISO/IEC 27001:2022, ISO 27017, ISO 27018, FIPS 140-2, Common Criteria NIAP, PCI DSS

Versa's trust centre lists certifications (SOC 2 Type II, SOC 3, ISO 27001:2022, ISO 27017/27018, FIPS 140-2, Common Criteria, PCI DSS) with links to reports and certificates, but the fetched page content did not surface specific data residency, log retention, SLA or sub-processor detail.

Does not prove: Rejected as a standalone source row because it duplicates certification facts already sourced from the more specific 2025 certification press release and FIPS/Common Criteria releases, and did not itself surface data residency, retention, SLA or sub-processor detail despite being the natural page for it.

versa-networks.com · Checked 12 Sept 2026

Versa Networks - Customer Case Studies index page (Adobe, Dell, Lintasarta, Lambton Area Water Supply Systems and others)

Named service:

Not applicable

Regulatory regime:

Not stated

RCBC uncovered centralized control, scalable security, and superior network performance, while enabling seamless, and secure banking to all customers regardless of their location.

This is a navigation/listing page pointing to the individual financial services case studies (Fortune 500 financial services company, Global Financial Services Firm, Global Credit Card Payments Company, RCBC) which were opened and sourced separately.

Does not prove: Rejected as a duplicate source row; used only to locate the individual case study PDFs, which are sourced separately above.

· Published 22 Jul 2025 · Checked 12 Sept 2026

Our Customers | Versa Networks

A Fortune 500 financial services company chooses software defined WAN (SD-WAN) to transform their legacy architecture

Strongest sector evidence for this supplier. Two independent strands on the vendor's own site: a Fortune 500 financial services customer story on the homepage, and a Gartner Peer Insights review published on the customers page attributed to 'Network Engineer – Banking'. A dedicated page is also listed at https://versa-networks.com/solutions/industries/financial-services/ but could not be loaded. Neither customer is named.

Does not prove: Tier 1 supplier material. versa-networks.com sits behind an Imperva JavaScript bot wall returning only 'Javascript is required' to non-browser clients, so this was read via the text proxy https://r.jina.ai/https://versa-networks.com/customers/ where every quoted string reproduces. Attributions are anonymised Gartner Peer Insights reviewers labelled by industry, not named customers. | Not found on page

versa-networks.com · Published 4 Apr 2022 · Checked 29 Jul 2026

Versa Networks site navigation, Industry Solutions menu, rendered on the /company/ 404 page

A Fortune 500 financial services company chooses software defined WAN (SD-WAN) to transform their legacy architecture

Strongest sector evidence for this supplier. Two independent strands on the vendor's own site: a Fortune 500 financial services customer story on the homepage, and a Gartner Peer Insights review published on the customers page attributed to 'Network Engineer – Banking'. A dedicated page is also listed at https://versa-networks.com/solutions/industries/financial-services/ but could not be loaded. Neither customer is named.

Does not prove: Tier 1 but weaker than a live page. This URL 404s; its 'Looking for something?' block renders the full site navigation including an Industry Solutions menu of dedicated industry page URLs. Read via https://r.jina.ai/https://versa-networks.com/company/. The individual industry pages could NOT be loaded: reader attempts returned HTTP 429 and direct attempts hit the bot wall. Verified navigation entries, not verified page content, so possibly stale. | Not found on page

versa-networks.com · Checked 29 Jul 2026