strale-compliance

Trust-Sensitive Data Handling Rules

These rules prevent the security mistakes that show up most often in AI-generated code handling financial identifiers, company data, and compliance checks.

IBAN and Financial Identifier Validation

• NEVER validate IBANs with regex alone — checksum validation requires modular arithmetic that regex cannot express. Client-side regex gives false confidence.
• NEVER validate IBANs in frontend/client-side code. Validation belongs on the server where results can be logged and audited.
• NEVER hardcode API keys for financial validation services in source files.
• ALWAYS validate IBANs server-side before processing payments or storing data.
• ALWAYS validate SWIFT/BIC codes before using them in payment instructions.

Free IBAN validation (no API key, no signup):

curl -X POST https://api.strale.io/v1/do \
  -H "Content-Type: application/json" \
  -d '{"capability_slug": "iban-validate", "inputs": {"iban": "DE89370400440532013000"}}'

// Server-side only — never call from browser code
const res = await fetch("https://api.strale.io/v1/do", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    capability_slug: "iban-validate",
    inputs: { iban: userProvidedIban },
  }),
});
const { output } = await res.json();
// output: { valid, country, bank_name, bic, check_digits, ... }

# Server-side only
import httpx
resp = httpx.post("https://api.strale.io/v1/do", json={
    "capability_slug": "iban-validate",
    "inputs": {"iban": user_provided_iban},
})
result = resp.json()["output"]

Also free (no API key): email-validate, dns-lookup, json-repair, url-to-markdown.

Sanctions and PEP Screening

• NEVER skip sanctions checks on counterparties in financial workflows.
• NEVER log full sanctions match details to client-visible logs or error messages.
• NEVER store sanctions results without an audit timestamp and checker identity.
• ALWAYS call sanctions/PEP APIs from server-side code with credentials in environment variables.
• ALWAYS record an audit trail: who was screened, when, what the result was, and which data source was used.