Built for people who answer to regulators
BankRegReports analyzes public regulatory filings, not your institution’s confidential data. Every figure traces back to the official record it came from, and the platform runs on infrastructure providers that hold their own independent audits.
Auditable by design
Every number comes from a named public filing: FFIEC Call Reports, UBPR, or another regulatory source. Where a metric is a direct Call Report line item, we show the MDRM code it maps to. Derived ratios are computed from those line items, and the glossary publishes the formula for each glossary metric.
Public data, by design
We work exclusively from public regulatory sources: FFIEC Call Reports, FDIC, Federal Reserve NIC, OCC, NCUA 5300, and SEC filings. We do not ingest, store, or process your institution’s confidential or customer information. The personal data we do hold is about our own users: account details, sign-in and usage records (including IP addresses), and billing addresses. The privacy policy lists all of it.
Encrypted in transit and at rest
All traffic is encrypted in transit with TLS 1.2+. Data at rest is encrypted with AES-256, with keys held in dedicated key-management services by our database provider.
Infrastructure providers and their audits
We don’t run our own data centers. Every layer (application hosting, managed database, and network edge) runs on providers that hold their own current, independent third-party audits.
| Layer | Independent attestations |
|---|---|
| Application hosting | SOC 2 Type II, SOC 3, GDPR, EU-US & Swiss-US Data Privacy Framework |
| Managed database | SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 27701:2019, GDPR, CCPA/CPRA |
| Network, DNS, CDN & WAF | SOC 2 Type II, ISO 27001:2022, ISO 27701:2019, ISO 27017/27018, PCI DSS 4.0, FedRAMP Moderate |
| Payments | PCI DSS Level 1, SOC 1 Type II, SOC 2 Type II, SOC 3 |
These attestations belong to our infrastructure providers, which BankRegReports builds on. Payment card data is handled entirely by our PCI DSS Level 1 payment processor and never touches our servers.
Compliance documentation on request
Independent audit reports for our infrastructure and payment providers (including SOC 2 Type II, ISO 27001/27701, PCI DSS attestations, and penetration-test summaries) are available to qualified prospects under NDA, naming each provider. If your vendor-risk team needs specific documentation, contact us and we’ll provide it.
Request documentationAccount security
The controls we run directly, on top of the provider infrastructure above.
Authentication & sessions
- Two-factor authentication by authenticator app or email code
- Passwords hashed with PBKDF2-SHA256; never stored in plaintext
- Short-lived, sliding sessions with Secure, HttpOnly, SameSite cookies
Platform hardening
- Web Application Firewall and bot protection at the network edge
- Strict Content-Security-Policy, HSTS, and CSRF protection
- IP-based rate limiting and automated abuse detection
Logging & monitoring
- Authentication and administrative actions are logged
- Usage logs are IP-anonymized and pruned on a rolling schedule
- Error monitoring is configured to exclude personal data
Data handling
- Analytics and advertising cookies are off until you accept them
- We never sell your personal information
- We share personal data only with the service providers listed in our privacy policy
Responsible disclosure
We welcome reports from security researchers. If you believe you’ve found a vulnerability, email security@bankregreports.com with enough detail to reproduce it. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and avoid privacy violations, data destruction, or service disruption while testing. Acting in good faith under this policy, we will not pursue legal action against you. Our machine-readable contact is published at /.well-known/security.txt.
Built by practitioners
BankRegReports was built by engineers, data scientists, and quantitative-finance practitioners who came up building software and data systems at Fortune 500-scale enterprises, including large-scale AI. That mix, markets fluency plus institutional engineering discipline, sets the bar: rigorous data validation, least-privilege access, and defense-in-depth are how we work by default, not features we bolted on for a regulated audience.