Due diligence documentation for the institutions we serve
VeriFyve is a technology service provider to banks and credit unions, so our controls sit inside your third-party risk program. This page describes how we operate. The underlying reports and policies are released to a named institution under a mutual confidentiality agreement, and every copy is watermarked to the organization that received it.
Data protection
Customer information is confidential by default, encrypted in transit and at rest, and never used to train AI models.
Access control
Individual accounts, role-based least privilege, mandatory authenticator-app two-factor, and server-side authorization on every action.
Institution isolation
Every record is walled to one institution in the database and again in the application, with automated tests proving it on each release.
Recovery
Nightly per-institution archives with a five-year retention schedule, restore tooling, and a 24-hour recovery time and recovery point objective.
Collected annually by a vendor-management program. Availability of each item is shown inside the library once access is granted.
- SOC 2 Type II report (or bridge letter)
- Certificate of insurance / cyber liability attestation
- Annual financial statements
- BCP / DR plan summary and last test result
- Information security policy summary
- Independent penetration test summary
- Privacy notice and data-handling statement
- Master agreement and service level commitments
- Subservice provider (fourth party) list
- AI supervisory disclosure (CSBS framework)
Written to the structure examiners expect under the FFIEC IT Examination Handbook and the Interagency Guidance on Third-Party Relationships.
- Information Security PolicyVF-POL-01
- Business Continuity and Disaster Recovery PolicyVF-POL-02
- Incident Response PolicyVF-POL-03
- Third-Party and Subservice Provider Management PolicyVF-POL-04
- Change Management PolicyVF-POL-05
- Access Control and Identity Management PolicyVF-POL-06
- Data Classification, Retention and Destruction PolicyVF-POL-07
- Privacy and Data Handling PolicyVF-POL-08
- Secure Software Development PolicyVF-POL-09
- Artificial Intelligence Governance PolicyVF-POL-10
How access works
- 1. Request
Tell us who you are and why you need the package.
- 2. Sign
We email a link to a mutual confidentiality agreement you accept online.
- 3. Open
The library opens immediately and stays open for 90 days.
- 4. Download
Each document is watermarked with your organization's name and the confidentiality legend.
Signing is an electronic signature under the federal E-SIGN Act. We record the signer's name and title, the organization, the version of the agreement accepted, the time, and the network address used. Access can be renewed or withdrawn at any time.