Security & Compliance

Your retirement data is mission-critical. We treat it that way — with enterprise-grade security and rigorous compliance built into everything we do.

Data Encryption
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Your sensitive information is protected at every step.
Access Control
Role-based access control with multi-factor authentication. Only authorized personnel can access sensitive data, and every access is logged.
Audit Trails
Complete audit logging of all system activity. Every data transformation, approval, and access is tracked and available for compliance review.

Enterprise-Grade Infrastructure

Cloud-Native Architecture: Built on AWS with multi-region redundancy, automatic failover, and 99.99% uptime SLA.
Isolated Data Environments: Multi-tenant architecture with database-per-client isolation. Your data never mixes with anyone else's.
Automated Backups: Continuous backups with point-in-time recovery. Your data is protected against any scenario.
Network Security: VPC isolation, WAF protection, DDoS mitigation, and encrypted VPN connectivity.
Vulnerability Management: Regular penetration testing, automated scanning, and rapid patching procedures.
Incident Response: Documented incident response with defined escalation paths and communication protocols.

We maintain rigorous compliance standards appropriate for handling retirement plan data.

In Progress
SOC 2 Type II
Currently pursuing SOC 2 Type II certification for security, availability, and confidentiality.
Active
ERISA Compliant
Full compliance with ERISA requirements for retirement plan data handling and fiduciary responsibilities.
Active
Data Privacy
Adherence to state and federal data privacy requirements, including participant consent and disclosure.

Data Retention
We retain data in accordance with ERISA requirements (minimum 6 years) and your service agreement. Upon termination, data is securely deleted or returned per your instructions.
Data Ownership
You retain full ownership of all data you provide. We process it solely to provide services and never sell or use it for any other purpose.
Secure Transmission
All file transfers use encrypted channels (SFTP, HTTPS). We support secure API integrations and encrypted email for sensitive communications.
Employee Access
Access to customer data is strictly limited to personnel who require it for service delivery. All employees complete security awareness training.

We're happy to discuss our security practices in detail or complete your vendor security questionnaire.