Security & Data Protection
We employ a financial-grade security architecture built on AWS to ensure that sensitive data is encrypted, access-controlled, and fully auditable.
Overview
Sensitive financial data is encrypted at the application layer before it is written to durable storage. We use AWS Key Management Service (KMS) for key material and envelope encryption; no plaintext financial data is ever stored at rest.
Access is restricted through least-privilege IAM roles and service boundaries. Administrative and cryptographic activity is logged and available for audit so that key usage and access patterns remain traceable.
Security Principles
These practices form the baseline for how we handle confidential data across our environment.
Encryption by Default
All sensitive data is encrypted using AES-256.
Envelope encryption is backed by AWS KMS.
No Stored Secrets
No long-lived credentials.
All access uses short-lived, federated identity.
Least Privilege Access
Only backend services can decrypt.
No human access to production financial data.
Full Auditability
All key usage logged via AWS CloudTrail.
Complete traceability of access events.
How we protect data
- Data is encrypted as soon as it is accepted by our services.
- At rest, only ciphertext is stored; keys are managed separately in KMS.
- Decryption happens only in memory within authorized backend processes.
- User-facing surfaces use masked or redacted values where full detail is not required.
- Encryption keys never leave the AWS KMS boundary under our control.
Security Documentation
Materials for the public, our technology and bank partners, and security reviewers.
Information Security Policy
Detailed description of our Information Security policies and procedures.
Access Control Policy
Detailed description of our Access Control policies and procedures.
Data Retention Policy
Detailed description of our Data Retention policies and procedures.
Incident Response Policy
Detailed description of our Incident Response policies and procedures.
Cryptographic Key Management and Data Protection Architecture
Detailed description of our Cryptographic Key Management and Data Protection Architecture policies and procedures.
SOC 2 Control Narrative
Detailed description of our SOC 2 Control Narrative.
SOC 2 Control Matrix
Detailed description of our SOC 2 Control Matrix.
Partner Bank Due Diligence Responses
Detailed description of our Partner Bank Due Diligence Responses.
Have questions about our security architecture?
We are happy to walk through controls, architecture, and diligence materials with qualified partners.
Contact us