Handling SSNs, bank numbers and IDs

A single funding file contains almost everything needed to steal an identity and empty a bank account: the owner's Social Security number and date of birth, a driver's licence image, bank account and routing numbers, a voided check, months of bank statements and often a credit report. Multiply that by every application you have ever taken. That is why lending shops are a target, and why a lost laptop or a forwarded email can become a breach.

Federal law may apply too. The FTC's Safeguards Rule, under the Gramm-Leach-Bliley Act, requires some non-bank financial companies to run a written information security program, with a person in charge, risk assessments, access controls, encryption, multi-factor authentication and incident response, and to report certain breaches to the FTC. Whether it applies to your shop depends on what you do and whose data you hold; owners' personal data is part of nearly every business file. Ask counsel whether you are covered, and treat its controls as good practice either way.

In Ferrylend, SSNs, EINs, dates of birth, driver's licence numbers and bank numbers are encrypted at rest and shown masked. Revealing a value takes a deliberate click and the reveal permission (read-only users cannot), and each reveal is written to the audit log. Exporting is its own permission and every export is logged. Documents are private and streamed only to users allowed to see them. See roles and permissions, audit log and data security and security.