Security
Bank data, handled like bank data.
A verification file contains account numbers, balances and transactions. The controls below describe how FinClarity limits who can see it, how long it stays, and what we do not hold at all.
Bank verification and stacking intelligence for MCA lenders.
BYOP
Plaid on your account
TLS
Every connection
AES-256
At rest
30 days
Default recording retention
Controls
How the platform is built.
Bank credentials never reach us
Borrowers authenticate with their bank or with Plaid. FinClarity does not receive, proxy or store bank usernames and passwords.
Encryption in transit and at rest
TLS for every connection. Encrypted storage for the database and object storage that hold verification data.
Field-level protection for secrets
Access tokens and signing keys are encrypted separately from application data and decrypted only in the service that uses them.
Organization-scoped access
Every record is read through an organization-scoped query. A lender cannot open another lender's verification, recording or report.
Two-factor sign-in
Dashboard access uses password plus a one-time code. Organizations can require it for every member.
Links that expire
Borrower verification links are single-purpose and time-limited. Recordings and reports are served through short-lived signed URLs.
Recording retention
Session recordings are deleted 30 days after a verification completes. Metadata, results and network events stay with the file.
Consent on the borrower side
SMS passcodes require explicit, logged consent with HELP and STOP handling. The wording lives on the SMS Policy page.
Where we are
Status, without the badge collection.
Compliance work is a sequence, not a logo. We publish what is finished and what is still running, and we will not describe the platform as certified until a report exists.
Evaluating us? Ask for the security questionnaire, the current subprocessor list and implementation status. We send them under NDA.
Request the security packResponsible disclosure
Found something? Tell us first.
We welcome reports from researchers. Send a description, the affected URL and reproduction steps to security@finclarity.io. Do not access, modify or retain borrower data, and give us a reasonable window to fix the issue before publishing.
Data requests
Privacy and deletion.
Access, correction and deletion requests go to privacy@finclarity.io. Retention rules and the categories of data we collect are set out in the Privacy Policy.