Is CertAware secure with member data?
Yes. CertAware runs on Amazon Web Services in the US East (us-east-1) region, encrypts data in transit and at rest, keeps a tamper-evident audit trail, enforces least-privilege access with MFA on admin accounts, and isolates every credit union’s data. Here is exactly what that means, in plain English a compliance officer and an examiner can both use.
What we do today
US hosting on AWS (us-east-1)
CertAware runs on Amazon Web Services in the US East (N. Virginia) region — AWS App Runner for the application and Amazon RDS for the database. Your data stays in the United States.
Encryption in transit and at rest
Every request is served over HTTPS/TLS. Data at rest uses AWS-managed encryption for the database and object storage.
Tamper-evident audit trail
Security-relevant actions are written to a hash-chained audit log. Each entry cryptographically covers the one before it, so altering, deleting, or reordering any record breaks the chain — evidence you can show an examiner.
Least-privilege access & MFA
Access follows least-privilege principles, and privileged admin accounts are protected with time-based one-time-password (TOTP) multi-factor authentication.
Tenant isolation
Each credit union is a separate tenant. One credit union cannot see another's staff, members, records, or reports.
PII minimization & de-identification
The free scam checker redacts obvious personal identifiers (card-like numbers, SSNs, emails, phone numbers) before anything is stored or sent to a model. Member personal information is never used to train AI models.
SOC 2 & formal attestations
We handle credit-union data on AWS with encryption, least-privilege access, MFA, and a tamper-evident audit trail. Our current SOC 2 posture and roadmap — and any third-party attestations — are shared with due-diligence teams during an active review.
Common security questions
- Where is CertAware hosted?
- CertAware runs on Amazon Web Services in the US East (N. Virginia / us-east-1) region, on AWS App Runner with an Amazon RDS database.
- Is data encrypted?
- Yes. All traffic is served over HTTPS/TLS in transit, and data at rest uses AWS-managed encryption for the database and object storage.
- How is access controlled?
- Access follows least-privilege principles, privileged admin accounts use TOTP multi-factor authentication, and sessions use httpOnly, SameSite, Secure-in-production cookies. Every credit union's data is isolated per tenant.
- Is CertAware SOC 2 certified?
- We handle credit-union data on AWS with encryption, least-privilege access, MFA, and a tamper-evident audit trail. Our current SOC 2 posture and roadmap are shared with due-diligence teams during an active review.
- Is member personal information sent to AI models?
- No. The free scam checker redacts obvious personal identifiers before anything is stored or sent to a model, and member personal information is not used to train models.
Want to know how the AI works and stays governed? See our AI governance page.