Executive Summary
AI-generated analysis for Airwallex
Airwallex (airwallex.com) is a global payments and financial platform assessed at Tier 4 (Low Risk) with a 90% confidence score, reflecting a well-established vendor with a strong compliance posture and clean threat profile across all major security signal categories. Airwallex presents a number of meaningful positive signals:
Key Findings
- The domain has been registered since 2015 and archived since 2016, demonstrating over a decade of established online presence.
- Infrastructure exposure is minimal, with only 2 open ports (80 and 443) detected and zero known CVEs — well below the SaaS industry average of 8–12 open ports, representing a tightly controlled attack surface.
- The domain is clean across all threat intelligence channels: zero Malware detection service flags, zero malware or phishing indicators, zero abuse reports on the hosting IP, and zero threat intelligence pulses in the open threat exchange.
- Airwallex explicitly commits to not training AI models on customer data, a meaningful privacy signal for organizations with sensitive data handling requirements.
- Multiple compliance certifications are claimed on the vendor's public trust page at https://security.airwallex.com, including SOC 2 (Type I and Type II), SOC 1 (Type II), PCI DSS, ISO/IEC 27001, CSA STAR, GDPR, and DORA. The SOC 2 claim is backed by a Drata trust platform, indicating active compliance program management.
- Multiple Airwallex legal entities appear in ISO 9362 BIC regulatory databases across the UK, Netherlands, Australia, and Hong Kong — consistent with a legitimately regulated financial institution operating across multiple jurisdictions. No sanctions or enforcement matches were found.
- HTTP security headers scored a B (70/100) from an independent scan, with 8 of 10 tests passing. Two areas warrant follow-up attention before this vendor is fully onboarded. First, all five certifications claimed on the trust page are vendor-attested and could not be independently verified through public registries — formal copies of the SOC 2 Type II and PCI DSS Attestation of Compliance (AOC) should be requested directly from the vendor's security team. Second, Airwallex's subprocessor page at https://security.airwallex.com/subprocessors was detected but could not be automatically parsed, leaving the third-party supply chain unreviewed. Additionally, a Hacker News post from December 2025 references allegations of a "China backdoor" — while this did not trigger a risk signal in automated scanning and has not appeared in adverse media sources, it warrants awareness given Airwallex's Chinese founding history, and compliance teams may wish to monitor ongoing coverage. Overall, Airwallex presents a low-risk profile appropriate for a medium data access engagement. The primary outstanding actions are documentation-focused: obtaining certification reports, manually reviewing the subprocessor list, and filing this assessment as SOC 2 CC9.2 evidence. The platform is assessed as approvable subject to those documentation steps.
Independence Statement
All evidence in this report was independently sourced from external data providers, public registries, and open-source intelligence without any participation or input from Airwallex.