Security
What happens to member data
You are a regulated institution and we are an unfamiliar vendor. The burden is ours. Here is exactly what the platform does, in enough detail that your examiner or your core provider can take issue with it.
- No member PII is collected in the conversation
- The assistant is not designed to ask for a Social Security number, an account number, or a date of birth, and it does not need any of them to answer a loan question or book an appointment. When a conversation genuinely requires that information, it hands off to your staff in your own systems. The safest way to protect member data in a chat channel is not to put it there.
- Field-level AES-256-GCM encryption
- Sensitive fields are encrypted individually before they reach the database using AES-256 in GCM mode with a 128-bit authentication tag, not merely encrypted at rest by the storage layer. The platform refuses to start in production without an encryption key configured.
- PII is masked before it reaches a log
- Log output passes through a masking layer that redacts Social Security numbers, email addresses, phone numbers and card numbers — including partial forms such as a last-four quoted next to the word 'social'. Voice transcripts are redacted on the same basis.
- Immutable audit trail
- Audit records cannot be updated or deleted once written; the constraint is enforced at the persistence layer and covered by tests, not left to application convention.
- Per-tenant isolation
- Every record carries its credit union's tenant identifier, and tenant context is enforced through the request path including asynchronous work and WebSocket connections. One credit union's data is not reachable from another's session.
- Your inquiries are never resold
- Inquiries generated for your credit union are yours. They are not syndicated, sold, or routed to another lender. There is no second buyer for your members' interest, which is the difference between this and a lead broker.
What we do not have yet
We do not hold a SOC 2 report. We are a new company and no credit union is live on the platform yet. If a completed SOC 2 is a precondition for you, we are not there — and we would rather tell you that on the first call than in month three of a procurement review.