Your responsibilities
The partner API's security rests on controls on both sides. Ours are in the security profile; these are the ones your institution runs, and our own controls rely on them.
What your institution does
Each institution that uses the partner API must:
- keep keys in a secrets manager, never in code or email;
- remove departed staff and roll their credentials within 1 business day;
- verify every webhook signature, and secure their own endpoints;
- keep IP allowlists, the security and 12 CFR 53.4 contacts, and the Administrator of Record current;
- confirm payout and remittance changes only out of band;
- keep the bank details in their own payout account with our payment processor current: the processor verifies changes there, and they are the payee's responsibility;
- refer borrowers only with a lawful basis;
- define the scope they grant to any platform they designate to act for them.
Where each is described
- Credentials and signing: the keys and signed credentials you keep, how long each lives, and how to roll one.
- Webhook verification: how to verify the signature on every webhook before acting on it.
- Security profile: our side, including IP allowlists and how long each record is kept.
- Data dictionary: every field a request or a response carries, and the class of data each one holds.
What we give you to help
At launchThe portal lists your institution's seats with each one's last sign-in date, for your own access reviews, so a departed colleague's seat is easy to find and remove.
If you think a key or a signing key has been exposed, revoke or roll it in the portal and tell us at once: Support says where.