This Written Information Security Program ("WISP") documents the administrative, technical, and physical safeguards RAVEN maintains to protect the confidentiality, integrity, and availability of customer information processed through the platform. It is designed to satisfy the Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314), the FFIEC Information Security Handbook, and the data-protection elements of the CFPB Personal Financial Data Rights Rule (12 CFR Part 1033).
This WISP applies to all RAVEN employees, contractors, infrastructure, third-party service providers, and to all consumer data processed on behalf of RAVEN's customers (U.S.-chartered, federally insured depository institutions).
2. Qualified Individual
The Qualified Individual responsible for overseeing, implementing, and enforcing this WISP is the RAVEN Security Lead. The Qualified Individual reports to the governing body at least annually on the status of the program, material risks, results of testing, and any security incidents.
Qualified Individual: Isaac Welch, Security Lead
Contact: security@reportraven.tech
3. Risk Assessment (16 CFR §314.4(b))
RAVEN conducts a documented risk assessment at least annually and whenever there is a material change to the platform, the threat landscape, or the regulatory environment. The risk assessment:
Identifies foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, destruction, or other compromise of customer information
Evaluates the likelihood and potential damage of each threat, taking into account the sensitivity of the information
Assesses the sufficiency of existing policies, procedures, customer-information systems, and other safeguards in place to control these risks
Drives the selection and prioritization of the controls described in this WISP
4. Safeguards (16 CFR §314.4(c))
4.1 Access Controls
Role-based access to production systems; least-privilege administration
Multi-factor authentication required for all administrative access to AWS, source control, identity provider (Clerk), and any system that can read decrypted customer information
Production API keys are stored as SHA-256 hashes; raw keys are shown once at creation and never persisted (`src/tenancy/api-key.ts`)
Multi-tenant isolation enforced at the data layer; module-level permission gating per tenant; sandbox and production environments separated at the key level
Consumer access is gated by verification tiers (OTP, enhanced OTP, identity-match) with lockout after repeated failures
4.2 Asset and Data Inventory
Inventory of systems that store, process, or transmit customer information is maintained and reviewed at each material change
Data classification distinguishes customer information (regulated), tenant operational data, and non-sensitive marketing data
4.3 Encryption
Encryption at rest: AES-256-GCM with per-user Data Encryption Keys (DEKs); DEKs are themselves encrypted under AWS KMS master keys (envelope encryption); field-level encryption such that compromise of one field does not expose others; key rotation managed by AWS KMS
Encryption in transit: TLS 1.2 or higher on all API endpoints and outbound provider calls
Crypto-shredding: deleting a consumer's DEK renders that consumer's data permanently unrecoverable, including from backups — supporting consumer revocation and deletion obligations under §1033 and state privacy laws
4.4 Secure Software Development
Source control with mandatory code review; protected main branch
Static analysis (TypeScript strict-mode typecheck, ESLint) gated in pre-commit hooks
Automated test suite (Vitest) covering store, tenancy, identity, providers, and webhooks
Dependency review and vulnerability scanning
Secrets stored in environment variables and managed services; never in source or logs
4.5 Multi-Factor Authentication
MFA is required for all access to administrative consoles, source control, the identity provider, and any system that can decrypt customer information. The requirement applies to RAVEN staff and to any third-party support engineer granted temporary access.
4.6 Monitoring and Logging
Structured JSON logs via Pino, with no PII written to logs
Per-request tenant ID and request ID captured for traceability
Every data change is recorded as an immutable event with actor, field-level before/after values, timestamp, and confidence score
Consent records store SHA-256 hashes of the exact consent text shown to the consumer
API access logs retained for the period required to support customer and regulator inquiries
4.7 Secure Disposal
Customer information is retained only as long as necessary for the consumer-requested product and applicable legal retention. Disposal is performed by crypto-shredding (DEK deletion), which renders the underlying data permanently unrecoverable. Disposal events are logged.
4.8 Change Management
All changes to production systems flow through source control with peer review. Schema changes, key-management changes, and changes affecting the audit trail receive additional review by the Qualified Individual.
4.9 Incident Response
RAVEN maintains a written Incident Response Plan (published at /legal/incident-response) that defines roles, severity tiers, escalation paths, evidence preservation, and notification commitments.
5. Service Provider Oversight (16 CFR §314.4(f))
RAVEN's Vendor Risk Management Program (/legal/vendor-risk-management) governs the selection, contracting, and ongoing oversight of all third-party service providers that receive or process customer information. The current list of subprocessors is published at /legal/subprocessors and updated with notice to customers on material change.
6. Testing and Monitoring (16 CFR §314.4(d))
Continuous monitoring through application logs, infrastructure alerts, and provider-health tracking
Annual penetration testing by an independent third party, with findings tracked to remediation
Annual tabletop exercise of the Incident Response Plan and Business Continuity / Disaster Recovery Plan
Annual SOC 2 attestation (Type I completed; Type II on an annual cycle)
7. Training (16 CFR §314.4(e))
All RAVEN staff complete security awareness training at hire and annually thereafter. Engineering staff complete additional secure-coding training. The Qualified Individual maintains training and credentials sufficient to the role and tracks the program's training compliance.
8. Customer and Consumer Information
RAVEN classifies customer information broadly to include nonpublic personal information received from financial institution customers and from consumers (including SSN, date of birth, account information, transaction history, and any other data processed through the platform).
9. Annual Review and Reporting (16 CFR §314.4(i))
The Qualified Individual reports to the governing body in writing at least annually. The report covers:
The overall status of the WISP and compliance with this policy
Material matters relating to risk assessment, risk management, control decisions, service provider arrangements, results of testing, security events, and management's response to them