Security Practices

ALFRED™ is built and operated by Fintech Reimagined LLC with security treated as a foundational requirement. This page describes the practices ALFRED follows to protect information entrusted to the platform.

Infrastructure

ALFRED’s infrastructure is designed to protect information across storage, transmission, access, and platform activity. Security is considered throughout the operation of our technology, not solely when a vulnerability or service disruption occurs.

Access to production systems is limited to authorized personnel according to their responsibilities. Fintech Reimagined maintains documented procedures for evaluating infrastructure updates, reviewing relevant vendor security notices, and assessing potential risks to the systems supporting ALFRED.

Our security reviews distinguish between safeguards that have been verified and matters requiring further investigation. Findings and unresolved risks are documented, assigned to responsible parties, and tracked through defined follow-up procedures.

Data Encryption

Information transmitted to and from ALFRED is encrypted in transit. We work with infrastructure and technology providers that support secure handling of information entrusted to the platform.

Not all information requires the same level of protection. Our Data Security Protocol distinguishes between public, internal, restricted, and sensitive restricted information. Financial records, identity-related information, credit data, uploaded documents, and account credentials require heightened handling controls.

Our internal standards address how information is collected, accessed, used, shared, retained, and reviewed. These responsibilities apply whether information is handled directly within ALFRED or through an authorized third-party service.

Data storage and retention requirements are reviewed in relation to the purpose of the information, applicable obligations, and the services involved. We continue refining and verifying these arrangements as the platform develops.

Authentication & Access Control

ALFRED uses Auth0 to support subscriber authentication and protected account access. Access to account information requires appropriate authentication.

Our internal security protocol establishes a least-privilege access standard. Personnel are authorized to access only the systems and information necessary to perform their responsibilities.

The protocol also requires individual user accounts, multifactor authentication for applicable administrative systems where supported, periodic reviews of administrative permissions, and removal of access when it is no longer authorized.

Access does not equal permission to disclose. A subscriber accessing ALFRED or selecting a capital opportunity does not, by itself, authorize the transmission of personal or business information to a lender. Information sharing remains subject to applicable consent, verification, and authorization requirements.

Third-Party Security

ALFRED works with external technology and data providers, including Plaid, to support authorized connections and platform functionality. The use of an established provider does not eliminate our responsibility to understand how information is handled.

Our Data Security Protocol requires consideration of the information a provider receives, the business purpose of the integration, access permissions, security safeguards, and procedures for responding to incidents or ending access.

When a third-party provider manages account authentication, that process takes place through the provider’s authorized connection system. ALFRED does not request or store the credentials used to sign in to connected third-party financial accounts.

ALFRED also distinguishes between information maintained for internal capital-readiness evaluation and information authorized for external submission. In ALFRED’s direct-to-business process, lender-facing transmission requires the subscriber’s affirmative authorization and applicable verification requirements.

We view consent, appropriate data use, and responsible provider oversight as essential parts of protecting the relationships entrusted to ALFRED.

Monitoring and Exception Handling

ALFRED’s security governance includes reviewing relevant infrastructure alerts, suspicious activity, vendor security advisories, access concerns, and unexpected system behavior.

The absence of a reported security incident is not, by itself, evidence that a system is secure. We recognize the importance of examining potential risks, verifying the effectiveness of available safeguards, and documenting issues that remain unresolved.

Fintech Reimagined maintains a formal Data Security Protocol covering incident identification, containment, escalation, assessment, recovery, notification considerations, and documented closure.

Our Security Check Log supports this process by recording reviewed systems, observations, available evidence, risk assessments, responsible parties, and follow-up requirements. Our operating protocol calls for recurring security reviews and additional assessments when material threats or changes warrant attention.

Security findings are not considered resolved merely because a service remains operational or a threat has not resulted in a confirmed compromise. Closure requires appropriate review and verification of the relevant corrective measures.

Separately, when ALFRED detects a potential anomaly, unauthorized write attempt, policy conflict, or unexpected output, Safe Mode may be triggered. In Safe Mode, automated actions such as state advancement, partner transmission, or external file activity may be paused pending review.

Additional information about Safe Mode and auditability is available on the Trust & Compliance page.

Reporting a Security Concern

Security is a shared responsibility. We encourage subscribers, institutional partners, service providers, and other stakeholders to report potential security vulnerabilities, unauthorized activity, or concerns involving information entrusted to ALFRED.

Reports are reviewed under Fintech Reimagined’s established security and escalation procedures. Where additional investigation, corrective action, or notification is required, the appropriate responsibilities and obligations are assessed.

If you identify a potential concern, contact us using the compliance email address below. Please describe the issue and any affected service without including passwords, account credentials, government identification numbers, or unredacted financial documents.

Our commitment is to approach security concerns with diligence, accountability, and respect for the people and organizations who place their trust in our technology.