ChangeWorks is built on industry-leading financial technology used by the largest U.S. banks, 9,000+ community institutions, and millions of consumers. Our financial technology partner adheres to the highest standards for data security, privacy, and regulatory compliance, backed by rigorous policies, controls, and ongoing audits.

We typically do not receive any data classified as personally identifiable information (PII) under applicable regulations. Still, all sensitive data is encrypted as a safeguard. Decryption requires dedicated hardware within our private network. Encryption keys are split and securely stored using both hardware and software encryption, with access restricted to a limited group of key custodians under a strict rotation schedule.

Each layer of our security architecture has independent access controls, and all access to the financial system requires multi-factor authentication. Infrastructure access is fully logged, audited, and monitored in real-time for anomalies such as unusual login attempts or file changes. Inbound and outbound traffic is tightly controlled across all layers, and all systems are routinely scanned and patched to eliminate known vulnerabilities.