Agencies hold other people’s budgets, so the bar is higher than for a normal expense tool. Here is how Kestrel is designed to handle cards, access and audits.
Card numbers are held by the card-issuing partner, never on Kestrel servers. Any card can be frozen instantly from the app.
SSO on Enterprise, separate roles for finance, account leads and buyers, and a log entry for every change to a limit.
A SOC 2 Type II report and a yearly external penetration test, shared under NDA on request.
Concept site: Kestrel isn’t a real company. The controls above describe the product as designed; no audit or certification has taken place. This site sends and stores nothing you type into it.