Security and Vulnerability Disclosure

1. What We Claim, and What We Do Not

Certifications we hold: none, at the effective date of this page. Banrox does not currently hold a SOC 2 Type I or Type II report, an ISO 27001 certificate, a PCI DSS Attestation of Compliance in its own name, or any other third party security certification. We say so here because a security badge a company has not earned is itself a security problem, and because a partner or a regulator checking us is entitled to a straight answer. When we complete an audit we will publish the report type, the auditor, the period covered, and how to request the report under a confidentiality agreement.

Card payments are handled by a PCI DSS validated payment processor. Banrox does not store, process, or transmit full primary account numbers on its own systems, and card data is tokenised by the processor.

Banrox is not a bank and holds no deposits. No Banrox product is insured by the Federal Deposit Insurance Corporation or by the National Credit Union Administration, and no page on this site should say or imply otherwise. If you find one that does, report it to [email protected] and we will correct it.

2. The Security Programme: What Runs Today, and What Does Not

The same rule that governs section 1 governs this section. A control Banrox cannot show you is not described here as though it were running. This section is written as at 12 September 2026, and it is split in two so that you can tell the difference between what Banrox does and what Banrox intends. Banrox maintains an information security programme appropriate to its size, complexity, and the sensitivity of the information it holds, of the kind the Gramm-Leach-Bliley Act Safeguards Rule at 16 C.F.R. Part 314 describes. Here is what is in it.

What Banrox runs today

What Banrox has not done yet

Banrox says these plainly rather than describe a programme it has not finished. Each one will be moved into the list above, with the date it was completed, when it is done.

• Banrox has not commissioned an independent penetration test. An earlier version of this page implied otherwise. It was corrected on 12 September 2026, and this line is the accurate statement.
• Banrox has not completed a SOC 2 or ISO 27001 audit, as section 1 already says.
• Banrox does not run a continuous security monitoring programme of the kind 16 C.F.R. section 314.4(d)(2) describes, and does not run a scheduled vulnerability assessment every six months. What it runs is the logging described above.
• Banrox does not have a written risk assessment. Until it does, this page does not claim one.
• Banrox does not have a written incident response plan. What binds Banrox in the meantime is section 3 of this page, which is a published commitment and does not depend on an internal document existing.
• Banrox does not make an annual written security report to a board.
• Banrox has not completed a data inventory recording every place personal information lives, who can reach it, and when it is destroyed. What exists today is the category, source, purpose and retention table published in the Privacy Policy.
• Banrox does not run a formal security awareness training programme with completion records. Banrox is a small team and says so rather than describe a training function it does not have.
• Banrox does not run a documented security review of a vendor before onboarding it, or a periodic reassessment of each vendor. What exists is the contract floor named above.

Four of those gaps line up with four requirements the Safeguards Rule itself does not apply to a financial institution that maintains customer information concerning fewer than five thousand consumers, at 16 C.F.R. section 314.6: the written risk assessment at 16 C.F.R. section 314.4(b)(1), continuous monitoring or annual penetration testing with vulnerability assessments every six months at 314.4(d)(2), the written incident response plan at 314.4(h), and the annual written report to the board at 314.4(i). Banrox lists them as gaps anyway, because the question worth answering is whether a control is running, not whether a rule compels it.

3. If Something Goes Wrong

If personal information about you is subject to a breach, Banrox will investigate, contain it, and notify you and the applicable regulators within the deadlines the law sets. Encryption does not change that: if information was encrypted but the key was also taken, Banrox treats it as unencrypted. If someone gains unauthorised access to information, Banrox treats it as acquired unless there is reliable evidence that it was not. Where a notification event affects 500 or more consumers, Banrox notifies the Federal Trade Commission as soon as possible and no later than 30 days after discovering it, as 16 C.F.R. section 314.4(j) requires, and Banrox meets every applicable state deadline.

Our notice will say what happened, when, what categories of information were involved, what we have done, what we are doing next, and what you can do, including how to place a free credit freeze. We will not delay a notice to manage publicity, and we will not describe a breach as an incident to make it sound smaller.

4. What You Control

• Use a password that is unique to Banrox. Reused passwords are how most account takeovers start.
• Turn on multi factor authentication in your account settings.
• Never share a one time code. Banrox will never ask you for one, on any channel, for any reason.
• Check the sender address on any email claiming to be Banrox. Banrox sends from an address at banrox.com, through the email delivery provider named at Service Providers and Data Recipients, so the message headers can show that provider as well. Banrox will never ask you by email for a password, a one time code, or a payment made outside your account.
• Tell us at [email protected] if you see activity you do not recognise. We would rather chase a false alarm than miss a real one.

5. Vulnerability Disclosure Programme

Safe harbour. If you research in good faith and follow the rules below, Banrox will consider your activity authorised, will not initiate or support civil or criminal action against you, will not report you to law enforcement, and will make it known to any third party who takes action that your research was authorised. If legal action is brought by someone else because of your good faith research, we will say so on the record.

Rules of engagement

• Test only against your own account or an account you have written permission to use
• Stop as soon as you can demonstrate the issue, and do not view, copy, retain or transmit any data belonging to another person
• No denial of service or resource exhaustion testing, no social engineering of staff, members or vendors, no physical intrusion, no spam or phishing
• Do not modify or destroy data, and do not degrade service for anyone else
• Report privately and give us a reasonable time to fix before any publication, and agree the date with us
• Comply with all applicable law, and do not condition disclosure on payment

In scope

banrox.com and its subdomains, the Banrox member dashboard, and Banrox APIs. Out of scope: third party services we do not operate, findings that require a compromised device or a person to be tricked, reports generated purely by an automated scanner with no demonstrated impact, missing headers or informational TLS findings with no exploit path, and rate limiting on unauthenticated public pages.

How to report and what happens next

• Email [email protected] with the steps to reproduce, the impact, and anything needed to verify it
• Banrox aims to acknowledge within 2 business days, and to give a triage decision and a severity within 10 business days. Those are targets Banrox sets for itself rather than deadlines any law imposes, and if Banrox misses one it will tell you where your report stands rather than go quiet
• We tell you when it is fixed, and we credit you publicly if you want to be credited
• Banrox does not currently run a paid bug bounty. We will say so up front rather than imply a reward that does not exist
• The safe harbour above does not depend on any of those targets being met. It applies from the moment you report in good faith

6. Law Enforcement and Legal Requests

We require valid legal process. We review every request for scope and legal sufficiency, we push back on overbroad requests, and we produce the minimum responsive information. Where we are permitted to tell the affected person, we do, and we will delay production where lawful to give that person a chance to object. We do not give any agency direct or bulk access to member data.

7. Contact

Security reports: [email protected]. Suspected fraud on your account: call (888) 888-6401 immediately and then email [email protected] so there is a written record with a timestamp.