This page lists the third-party subprocessors RAVEN engages to deliver its verification and aggregation services. Each subprocessor is reviewed under RAVEN's Vendor Risk Management Program for security posture, data-handling practices, contractual permissions, and ongoing performance.
RAVEN will provide notice to customers of material additions or changes to this list, in accordance with the Customer Agreement and applicable law.
2. Data subprocessors
The following subprocessors receive or process consumer-permissioned data on RAVEN's behalf for the purposes described:
2.1 Plaid
Purpose: Data aggregator under 12 CFR §1033.431. Consumer-permissioned access to bank accounts, transactions, identity, income, assets, and liabilities.
Data categories: Financial accounts, balances, transactions, income, identity, liabilities.
Region: United States.
2.2 Socure
Purpose: Identity verification, KYC, fraud and synthetic identity scoring, OFAC and global watchlist screening.
Data categories: Name, SSN, date of birth, address, contact, device signals.
Region: United States.
2.3 Truework
Purpose: Employer-verified employment, salary, title, and tenure.
Data categories: Employment status, employer, title, dates, compensation.
Region: United States.
2.4 Melissa
Purpose: Address verification and standardization, property records, demographics, and contact data.
Data categories: Address, phone, email, property details, demographic indicators.
Data categories: All consumer data at rest, encrypted with AES-256-GCM under KMS-managed envelope encryption.
Region: United States.
3.2 Clerk
Purpose: Customer (bank) user authentication and organization management for the RAVEN dashboard. Does not receive consumer data.
Data categories: Customer staff identity (name, email, organization membership).
Region: United States.
3.3 Vercel
Purpose: Marketing site and dashboard hosting. Does not store consumer data.
Data categories: Marketing site visitor analytics; no PII.
Region: United States.
4. Diligence and oversight
Each subprocessor listed above is engaged under a written agreement that obligates the subprocessor to:
Maintain administrative, technical, and physical safeguards consistent with the GLBA Safeguards Rule and the FFIEC Information Security Handbook
Limit use of consumer data to the purposes for which it is provided
Refrain from selling, licensing, or using consumer data for cross-marketing
Notify RAVEN of any security incident affecting consumer data within commercially reasonable timeframes
Cooperate with RAVEN's diligence, including SOC 2 (or equivalent) report production, on at least an annual cadence
5. Changes to this list
Material changes to this list are communicated to active customers through their primary point of contact and reflected on this page. Customers may object to a new subprocessor in accordance with the terms of their Customer Agreement.