How it works
There’s no fixed questionnaire. Every review is scoped to your business, because every vendor operates differently.
To participate
- 01Registered business in good standing
- 02Company website
- 03Handles sensitive broker, funder, or merchant information in alternative finance
We don’t ask every company the same questions. We learn how your business works, then agree with you on what to review and what evidence makes sense.
The expectations are the same for every vendor: protect the sensitive information you’re trusted with. What varies is how you do it and the evidence that shows it.
The process
- 01JoinTell us about your company and services. You get a membership and a directory listing. Payment isn’t due to join.
- 02ScopeWe learn about your services, data flows, and safeguards, and agree on what the review covers.
- 03ReviewWe agree on the evidence needed and conduct your review. Screenshots, documentation, existing reports, or a walkthrough all work.
- 04CertifyAssessment report, digital badge, and public announcement upon approval.
Membership does not guarantee certification.
Common starting points
These aren’t a checklist. They’re the areas most reviews touch on. Not every one applies, and we may add others that fit your business.
Access
How people sign in, including multi-factor authentication, and how access is removed when someone leaves.
Roles and permissions
Who can see, export, or download sensitive files, and whether your customers can restrict it.
Activity logging
Whether actions like viewing, downloading, and sharing are recorded.
Data separation
How one customer’s information is kept apart from another’s.
Retention and deletion
How long information is kept, and what happens when a customer leaves.
Third parties
Other providers or contractors that store, process, or access information on your behalf.
Data use
Whether information is ever shared, resold, or used beyond the service your customer signed up for.
Incidents
How you’d detect a problem and tell the customers affected.
Already have SOC 2 or ISO 27001?
They’re useful supporting evidence, but not required, and they don’t determine certification on their own. We’ll focus on what they don’t cover, like how sensitive information moves through your business in alternative finance.