What the platform holds, and what it never will.
A readable summary for your vendor review. The packet documents below are the reference; this page summarises them.
In short
No member data, by design
The academy trains on fictional cases. The platform has no place for member records, and we ask you never to enter any.
Text fields and links only
People type short answers or paste a link to a document that stays in your own systems. There are no file uploads.
Each credit union is walled off
Row-level security in the database separates every credit union’s records, and it is checked on every query.
Sign-in without passwords
People sign in with a one-time code or magic link sent to their work email. There is no password to steal or reuse.
An audit log
Significant actions, such as releasing an assessment result or deleting an account, are recorded in an audit log.
Retention and deletion
Each kind of record has a set retention period. Your credit union’s data can be deleted, and the audit trail keeps a record that it happened.
No AI model sees your data in version 1
The platform sends none of your credit union’s data to an AI model.
Hosted in the United States
The application runs on Vercel and the database on Supabase, both hosted in the United States.
Everything your vendor manager will ask for.
Read it here, or ask us for the packet as part of your due diligence. Questions we haven't answered go on the list, and we answer them in writing.
- Security overview
How the platform is built and run: architecture, isolation, sign-in, encryption and monitoring.
- Data inventory and flows
Every kind of data the platform holds, where it comes from, where it goes and who can see it.
- Subprocessors
The service providers that process data for the platform, what each does and where.
- Retention and deletion
How long each kind of record is kept, and how deletion works.
- Incident response
How we detect, handle and tell you about a security incident.
- Access control
Who can see what: roles inside a credit union, and our own staff access.
- Business continuity
Backups, recovery and what happens if a provider is unavailable.
- AI use statement
Where AI is and is not used in building the academy and running the platform.
- Vendor questionnaire answers
Answers to common vendor due-diligence questions, with links to the evidence.
What this page does not say
This summary makes no claim of certification, regulatory approval or compliance on your credit union's behalf. Your own vendor review decides whether we meet your requirements. The contract, including the data processing addendum, sets the terms that apply to an engagement.