Compliance & Regulatory

eCheck.io operates in compliance with all applicable federal and state regulations governing financial services and data processing. Our compliance framework is built on:

• Bank Secrecy Act (BSA) requirements
• USA PATRIOT Act provisions
• State money transmitter regulations where applicable
• Consumer Financial Protection Bureau (CFPB) guidelines
• Federal Trade Commission (FTC) data protection standards

We maintain the following certifications to ensure the highest level of security and compliance:

• SOC 2 Type II — Audited annually for security, availability, and confidentiality
• PCI DSS Level 1 — Highest level of payment card data security
• ISO 27001 — International standard for information security management
• NACHA Operating Rules — Compliant with ACH network requirements

Our certifications are independently audited and renewed on a regular basis.

We adhere to comprehensive data protection standards:

• GDPR compliance for European data subjects
• CCPA/CPRA compliance for California residents
• GLBA Safeguards Rule for financial data protection
• NIST Cybersecurity Framework alignment

All personal and financial data is handled according to the principle of least privilege, ensuring only authorized personnel have access to sensitive information.

We maintain rigorous audit and monitoring practices:

• Annual SOC 2 Type II audits by independent third-party auditors
• Quarterly penetration testing and vulnerability assessments
• Continuous monitoring of all systems and access logs
• Regular compliance training for all employees
• Incident response procedures tested bi-annually

Audit reports are available to customers upon request under NDA.

All third-party vendors and partners undergo rigorous due diligence:

• Security assessment before engagement
• Contractual obligations for data protection
• Regular review of vendor compliance status
• Immediate notification requirements for security incidents
• Right to audit provisions in all vendor agreements