Security your reviewers can check.
FinCalc puts calculators and lead forms on your website, next to your customers’ and members’ financial details. Here’s how we protect that data, and what we’ll share with your security and compliance teams.
| Item | Status |
|---|---|
| SOC 2 Type II | Audit in progress |
| WCAG 2.2 Level AA | At launch Conformance report on request |
| Single sign-on for staff | At launch |
| Penetration test | Before launch Summary under NDA |
Nothing leaves your page that you haven’t seen.
Many calculator and marketing tools load trackers and third-party scripts onto your site. FinCalc doesn’t.
- No third-party requests by default
The calculator talks only to FinCalc. No analytics, ad, or font services load inside it.
- Enforced, not just promised
A strict Content Security Policy blocks any connection that isn’t on the approved list.
- A manifest your counsel can read
We publish every outbound connection the calculator can make, in plain language.
# Every connection a FinCalc calculator can make # from your members' browsers calculations calc.fincalc.com purpose Compute results from entered values leads calc.fincalc.com purpose Send a lead the visitor chose to submit requires Recorded consent third parties none
Customer and member data, handled with restraint.
We collect what your team configures, keep it only as long as you decide, and make it easy to honor a member’s request.
Calculations aren’t logged
Financial values a visitor enters to get a result are not written to our engine’s logs when the calculation succeeds.
You choose what a lead form asks
Your team decides which contact fields appear and when, so you collect only what your follow-up needs.
Consent recorded exactly
Each channel’s consent is stored with the exact disclosure text the visitor saw, so you can show what they agreed to.
Withdrawal applies everywhere
When a member withdraws consent, it applies across every channel and notifies your connected systems, including Salesforce and webhooks.
Export or delete on request
Pull everything held about one person, or delete it, to respond to data requests.
Retention you set
Leads are purged automatically when your retention window ends.
Lead scoring that leaves the wrong signals out.
Scores help officers decide who to call first, so what goes into them matters.
| Signal | Used |
|---|---|
| Intent the visitor shows | Yes, with the reasons shown to the officer |
| Loan size | No |
| ZIP code | No |
| Referring page | No |
Scores are High or Medium, never a hidden number, and each one states why.
FinCalc is designed with fair lending, consumer contact, and privacy rules in mind, including the Equal Credit Opportunity Act and TCPA. Your institution remains responsible for its own compliance, and we’ll support your review.
A record of every change.
When an examiner asks who changed a disclosure and when, you’ll have the answer.
Tamper-evident audit log
Every configuration change and data export is logged, and a built-in check confirms the log hasn’t been altered.
Approved versions stay approved
Changes go through publish review, and a published version can’t be edited. What compliance approved is exactly what members see.
Single sign-on
Staff sign in to the console through your identity provider, so access follows your own onboarding and offboarding.
Separated access
Your administrators see your own institution’s activity and nothing else.
Signed webhooks
Lead events are signed using the Standard Webhooks specification, with secret rotation and a full delivery log.
Hosted in the United States.
FinCalc runs on Amazon Web Services, with the details your IT team needs available under NDA.
- U.S. regions only
Member and lead data is stored and processed in the United States.
- Encrypted in transit and at rest
Connections use TLS, and stored data is encrypted.
- Redundant, with disaster recovery
Services run across redundant infrastructure with disaster recovery.
Shared under NDA
- Architecture and data flow diagramsAt launch
- Hosting regions and recovery targetsAt launch
- Security policies overviewAt launch
- Penetration test summaryBefore launch
- Completed vendor questionnaire (SIG Lite or yours)On request
- SOC 2 Type II reportOnce issued
Accessible to everyone.
Calculators are designed to conform to WCAG 2.2 Level AA, and we’ll give you the report that shows it.
- Keyboard and screen reader support
Every field, result, and button works without a mouse and is announced clearly.
- Your branding stays accessible
Brand settings are checked against contrast requirements before publishing.
- Conformance report
An Accessibility Conformance Report based on an independent audit, available on request.
Questions from security reviewers.
Does the calculator set cookies or track visitors?
The calculator makes no third-party requests and loads no analytics or advertising trackers. Our outbound request manifest lists every connection it can make.
Where is our data stored?
On Amazon Web Services in U.S. regions. Specific regions and recovery targets are included in our security package.
Do you store the financial values members enter?
Not in our calculation engine’s logs for successful calculations. If a visitor submits a lead, the fields your form collects are stored for your retention window.
Can we complete our own vendor questionnaire with you?
Yes. Send it with your security package request and we’ll complete it.
When will the SOC 2 Type II report be available?
Our audit is underway. The report will be shared under NDA once it’s issued. Until then, we’ll walk your team through our controls.
How do we report a security issue?
Email info@fincalc.com with “Security” in the subject line. Please include steps to reproduce the issue.
Request our security package.
Tell us who’s reviewing, and we’ll send an NDA and the materials your team needs.