Money you’re saving for later should be there when you need it. Vestwell was built around that: data encrypted end-to-end, security reviews, and hundreds of controls tested each year by an independent auditor.
All plan data is encrypted. In plain terms, your data is scrambled so that only authorized Vestwell associates can read it. We have never used backup tapes or similar legacy physical media - we use Transport Layer Security (TLS) 1.3 to protect data in transit and AES-256 to protect data at rest, and rotate keys every 90 days.
Our staff gets access to what their job requires, and nothing more. Managers recheck that list every quarter. Our offices use badge readers, locked doors after hours, and cameras at every entrance.
We complete rigorous SOC 1 and 2 audits, penetration testing, and anti-money laundering audits, all run by independent firms. None have ever returned a material finding or a qualified opinion.
We built and maintain our own recordkeeping technology end-to-end, meaning we maintain control over updates and enhancements. Fewer outside dependencies mean fewer vulnerabilities and faster upgrades.
All data is encrypted, at rest and in transit. In transit, we use Transport Layer Security (TLS) 1.3, and at rest, we use a minimum of AES-256. We manage the keys through a key management service. Access to those keys is controlled, backups are encrypted, and we rotate keys every 90 days.
We don’t just grade ourselves. Independent auditors test hundreds of our controls every year. We go through SOC 1 and 2 audits, penetration testing, and anti-money laundering audits. No audit has ever returned a material finding or a qualified opinion.
Every loan and withdrawal request gets checked for signs that it was not really you. For your protection, we may call you, text you, email you, or block the request. If we think your account has been accessed by someone else, we can lock it.
We tell you when a distribution request or account profile change has been made. If you did not make or authorize the transaction, it is your responsibility to contact us.
Turn it on, and we’ll ask for a second proof of identity verification before distributions are processed or account profile changes are implemented.
Multi-tenant architecture and role-based permissions that hold up across programs and constituencies. For system access, we follow a least-privilege access model, and user access reviews are performed quarterly.
Staff can raise a security-related incident, which alerts our chief technology officer, chief information security officer, and general counsel. We start investigating incidents the same day, and within one hour for critical issues.
We met Department of Labor and SEC security guidance years before it was issued.
Multi-factor authentication (MFA) means we ask for a second proof that you are you, usually a code sent to your phone. It is one of the strongest steps you can take to protect your account. Pick a password that would be hard for someone to guess. Leave out your name, your birthday, and any part of your Social Security number. Do not reuse it on another site or share it with anyone. If you use a password manager, lock that too.
We use your contact details to reach you about your account, and to check that a transaction is really yours. If they are out of date, we may not reach you in time. Add a second email address and a mobile number.
We send an alert when money moves, when your contact details change, or when a new bank account is added. Read them. If you get a code you did not ask for, or an alert for something you did not do, tell us right away. If your statements or confirmations stop arriving, tell us that too. It can be a sign that someone changed your details.
Keep your computer, phone, and browser updated. Run antivirus software. Only install apps from a trusted source. Log out when you are done, and close the browser window. Try not to check your account on public Wi-Fi or a shared computer. Shred any documents with your personal details on it. Tell us as soon as your address changes. If your mail stops arriving for a few days, call the US Postal Service. Someone may be taking it.
If you give someone your login, or connect a budgeting app that asks for it, they can move money in your account. Think carefully before you share.
We will never call or email to ask for your password, your Social Security number, or a security code. Anyone who does is not us. Fraudsters build websites with addresses that look almost like ours. They send texts and emails with links to them. Some will even call you from a number that shows up as Vestwell and tell you something is urgent. If you are not sure, do not click the link. Type www.vestwell.com into your browser yourself. Check that the address bar shows https://www.vestwell.com before you log in to your account. Then send the suspicious message to Legal@vestwell.com.
Multi-factor authentication (MFA) means we ask for a second proof that a user is who they say they are, usually a code sent to a phone. It is the single strongest control available to you.
We use contact details to reach the right person about the plan, and to check that a transaction is really authorized. Review who has access regularly, and keep phone numbers and email addresses up to date for every one of them.
As soon as someone leaves your firm or company, or moves into a job that no longer needs platform access, let us know. Access that outlives the reason for it is one of the easiest ways in.
Anyone you give access to can act on the account, and we treat their actions as yours. That includes third-party applications that ask for a login in order to aggregate data. Think carefully before you share.
We send an alert when money moves, when contact details change, or when a new bank account is added. Read them. If a code arrives that nobody asked for, or an alert appears for something nobody did, tell us right away. Email Legal@vestwell.com or call (917) 979-5358 for any unrecognized activity. A delay can keep us from stopping a suspicious transaction, and it can affect what we are able to reimburse.
Keep computers, phones, and browsers updated. Run antivirus software. Log out and close the browser window when the work is done—closing the tab is not enough. Avoid checking plan accounts on public Wi-Fi or a shared computer.
Tell us immediately. Every minute counts. If we cannot stop a suspicious transfer because we heard about it late, it can affect what we are able to reimburse.
Let’s build the savings solutions that move your business, your people, and your future forward.
Discover how our proprietary technology streamlines every part of the savings experience.
See how we offer personalized, end-to-end support and expertise.
Explore how Vestwell's connectivity to leading providers allows key elements, like 401(k) contributions, to be processed through direct data feeds, giving everyone a better experience.
