CREDIT UNION DATA PROTECTION & VENDOR READINESS

Security and privacy for commercial credit information.

Borrower financial statements, tax returns, guarantor information and credit packages deserve careful handling. We work with each institution to agree on confidentiality, secure file sharing, permitted data use and the safeguards appropriate to its review process.

HOW REAL DATA WILL BE SHARED

How we arrange secure document sharing.

Confirm the scope

Agree on the review types, document checklist, delivery expectations and approved contacts. An introductory conversation requires no borrower files.

Complete vendor review

Share security and AI-data-use information, agree to confidentiality and processing terms, and complete your institution's required vendor diligence.

Share through an approved channel

Once your institution approves the transfer method, authorized users can provide permitted borrower and guarantor records through the agreed private channel.

Deliver and close the file

Limit access to approved personnel, prepare the review with senior credit oversight, and follow agreed retention, return and deletion rules.

SECURITY & PRIVACY REVIEW

Review our data-handling practices before engaging.

Before any engagement, your institution will be able to review our security, privacy and data-handling practices, including access controls, AI usage, third-party providers, retention and incident response. We will address your vendor due-diligence requirements and agree on the applicable safeguards and contractual terms before confidential information is shared.

Agreements, permitted use & privacy

What we agree with the credit union before collecting records

Vendor due diligenceLegal entity and ownership, qualified analysts, references as available, business continuity and financial or insurance information requested by the institution.

Confidentiality and data agreementsSigned master services agreement, statement of work, confidentiality/data protection terms, permitted purposes, customer data ownership, audit and termination rights.

Privacy, data scope and legal reviewDocument categories of borrower and guarantor information, applicable GLBA/NCUA and state privacy requirements, any consumer-report restrictions, and agreed data locations.

Approved file transferNamed secure intake channel and authorized institution contacts; never send borrower documents in the public inquiry form or unsecured prospecting email.

Technical safeguards & access

How borrower documents are safeguarded and access is controlled

Data isolation and secure storageDedicated customer-data environment, private file storage, verified institution-level isolation, protected backups and documented encryption in transit and at rest.

Identity and authorizationEnforced multi-factor authentication, least-privilege role access, approved analyst access, onboarding/offboarding and periodic access reviews.

Security testing and monitoringDocumented risk assessment, security event and document-access logs, vulnerability scanning, penetration testing and remediation of critical findings.

Safe intake and data minimizationMalware and document-type checks, limits on retained identifiers, classification controls, and safe handling of sensitive or accidentally submitted records.

AI, personnel & subcontractors

Who or what can see borrower information and for what purpose

AI processing inventoryDisclose which models and service providers receive which data, their hosting regions, retention practices and contractual protections.

Training and reuse restrictionsContractually prohibit model training, unrelated reuse and undisclosed sharing of customer information without separate express customer authorization.

Senior-review accountabilityQualified human analyst review, evidence traceability, exception disposition and correction tracking; no automatic credit approval or institutional risk grade.

People and supplier controlsConfidentiality, role-appropriate security training, background screening where justified, approved subprocessors and oversight of subcontractors.

Operational obligations & proof

Service, retention, incident and oversight terms to agree with your team

Retention, deletion and exportContracted retention periods, secure disposal and backup lifecycle, customer export or return, and evidence of deletion where feasible.

Incident response and notificationWritten detection and containment procedures, customer escalation contacts, prompt contract-specific incident notice and cooperation with regulator obligations.

Continuity and service levelsDocumented recovery and disaster response plans, responsible contacts, agreed turnaround, communication, corrections, support and remedies.

Audit-ready evidenceProvide written security policies, architecture and data-flow diagrams, risk findings, applicable independent assessments and insurance evidence when available or required.

YOUR INSTITUTION, YOUR DATA POLICIES

Review our practices before sharing a single file.

Before any engagement, your security, privacy and compliance teams can review our data-handling approach and discuss their requirements for access, approved AI providers, confidentiality, retention, incident response and third-party oversight. We agree on applicable terms and an authorized transfer process before exchanging confidential borrower information.

Your institution controls which documents it shares, who is authorized to use them and the lending decisions that follow. Any specific certifications or independent audit reports are provided only where available and verified.

Discuss your privacy and vendor requirements

Regulatory context

Guidance informing our readiness process includes NCUA Part 748 Appendix A (safeguarding member information and service-provider oversight), NCUA guidance on third-party due diligence, incident reporting and AI providers, as well as applicable GLBA, Regulation P, Fair Credit Reporting Act and state requirements. The customer's counsel and information-security team determine the specific onboarding requirements.

NCUA Part 748 Appendix A ↗Third-party due diligence ↗NCUA AI vendor guidance ↗