Compliance & Security
TrustedPortal maintains rigorous compliance certifications and security practices to support our clients' regulatory obligations.
Certifications & Frameworks
SOC 2 Type II
Independently audited annually by a licensed CPA firm. Our report covers Security, Availability, and Confidentiality trust service criteria. Available to clients and prospects under NDA.
Gramm-Leach-Bliley Act (GLBA)
Our safeguards program is designed to support financial institutions' obligations under GLBA Section 501(b). Administrative, technical, and physical controls are documented and tested regularly.
PCI DSS
For clients processing payment card data through our platform, we maintain PCI DSS Level 1 compliance with quarterly ASV scans and annual on-site assessments.
FFIEC Guidance
Our controls are aligned with FFIEC IT Examination Handbook guidance, including Authentication and Access to Financial Institution Services and Information Security booklets.
State Regulatory Requirements
We support compliance with state-specific requirements including NYDFS 23 NYCRR 500 (Cybersecurity Regulation) and California CCPA/CPRA where applicable to our clients.
Security Practices
Our security program includes:
• Annual third-party penetration testing by qualified CREST/OSCP-certified assessors
• Continuous vulnerability scanning and patch management (critical patches within 24 hours)
• Employee background checks and annual security awareness training
• Incident response plan tested quarterly with tabletop exercises
• Business continuity and disaster recovery tested semi-annually
• Encryption: AES-256 at rest, TLS 1.3 in transit, HSM-backed key management
Due Diligence Packages
We provide standardized due diligence packages for financial institutions evaluating our platform. Request via compliance@trustedportal.net.