Currencycloud Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Currencycloud

1. 1

   Request Currencycloud's current SOC 2 Type II report and bridge letter — contact their security or compliance team directly, or check whether a report is available via a trust portal (e.g., trust.currencycloud.com). If the report is under NDA, execute the NDA and retain a copy with this assessment for SOC 2 CC9.2 evidence.

   SOC 2 Overview (AICPA)
2. 2

   Request ISO 27001 certificate documentation directly from the vendor's compliance team, including the certificate number, issuing body, and expiry date. Cross-reference against the IAF CertSearch registry at iafcertsearch.org to independently confirm validity.

   ISO 27001 Standard
3. 3

   Verify HITRUST certification status by searching the HITRUST Alliance directory at directory.hitrustalliance.net and, if a match is found, confirm the certified entity name and scope align with the Currencycloud entity you are contracting with.

4. 4

   Obtain a written AI data handling statement or DPA addendum from Currencycloud addressing training data use, third-party AI subprocessors, and retention periods — contact privacy@currencycloud.com or their legal team via the contact details on currencycloud.com/legal. Complete within 30 days of contract signature.

   DPA Template (GDPR Art. 28)
5. 5

   Request written justification for all non-standard open ports (2082, 2083, 2086, 2087, 2095, 2096, 8880) from Currencycloud's security team, and confirm whether any of these are accessible from the public internet without authentication. Document the response in your vendor risk register.

   NIST Supply Chain Risk (SP 800-161)
6. 6

   Review Currencycloud's subprocessor list manually by visiting currencycloud.com/subprocessors directly in a browser; the automated extraction did not return a valid list. Document the confirmed subprocessors (including any cloud infrastructure providers) in your third-party inventory for GDPR Article 28 compliance.

   GDPR Full TextGDPR Subprocessor Rules
7. 7

   Document complementary user entity controls (CUECs) for your own SOC 2 boundary: if Currencycloud is in scope as a subservice organisation, your SOC 2 auditor will expect evidence of access control reviews, API key rotation schedules, and monitoring of Currencycloud-processed data flows. Retain this report with a reviewer signature and date as CC9.2 evidence.

   SOC 2 Overview (AICPA)

• Certificate Transparency log data (Certificate Transparency service) was unavailable during this investigation; subdomain enumeration was limited to a single certificate extracted from a direct TLS handshake. A full subdomain inventory could not be constructed.
• External cyber risk scoring was not available for this assessment; the vendor's cyber hygiene score relative to the SaaS industry average (76) could not be independently benchmarked.
• The subprocessor page at currencycloud.com/subprocessors returned what appear to be non-subprocessor text fragments ('If something feels off, contact us directly' and 'Learn About Our People World') rather than a structured subprocessor list. The vendor's actual subprocessor inventory could not be assessed from this source.
• The HITRUST directory match carries only 90% name confidence and cannot be confirmed as a certification for Currencycloud without direct verification with the HITRUST Alliance or the vendor.
• The AI policy evidence is drawn from a news article page rather than a formal policy document; the absence of a clear training commitment may reflect a policy publishing gap rather than an absence of internal controls.
• Domain reputation data from one threat intelligence source was partially unavailable; findings from other independent sources (Malware detection service, IP reputation service, Open Threat Exchange) all returned clean results with no malicious indicators.