This secure client portal is provided by RightCapital. Below is an overview of how they keep your data safe:

Data in Transit

  • All data transmission between your computer and our servers is encrypted, using industry-standard HTTPS protocol.
  • Our HTTPS implementation is rated A+ by independent Qualys SSL Labs.
  • Our SSL certificate uses 2048-bit asymmetric and 256-bit symmetric encryption.
  • We use HTTP Strict Transport Security (HSTS) to ensure only secure connections can be used for our website. Our website is accepted by and built in to Google Chrome, IE 11, Edge, and Firefox for this purpose.
  • Our servers take advantage of Perfect Forward Secrecy (FPS) to protect data transmission for modern web browsers. With forward secrecy, all past communication confidentiality is maintained even when a long-term secret key is compromised.

Data at Rest

All your personally identifiable information – including your name, e-mail, address, and uploaded documents – is encrypted when we store it. Such data is encrypted using Advanced Encryption Standard 256. AES-256 is an encryption algorithm established by the National Institute of Standards and Technology (NIST) and approved by the NSA for top-secret information.

Quantum Randomness

In cryptography, pseudorandom number generators are known to be insecure. Most computer hardware available in commercial markets is not capable of producing true random numbers.

For encryption purpose, we source true random numbers from a scientific device which measures the quantum fluctuations of the vacuum.

Two-step Verification

Two-step verification secures your account by requiring something you possess (your mobile phone), in addition to something you know (your password), to access your account.

Once enabled, you’ll need to enter a verification code from your mobile phone to log in. This protects your account from unauthorized access even when your password is compromised.

We Do Not Save Your Credentials

We partner with Yodlee to provide account aggregation. All of your banking credentials are managed by Yodlee, and we do not store your credentials. We communicate with Yodlee via an encrypted data link.