MoneyID / Security
Product in development
MoneyID is being developed to help your team check bank details against the vendor’s confirmation for your organization, and check saved details again before you pay. A match does not approve a payment. Your team decides whether to pay.
The person’s authority to act for the vendor is a design requirement.
In the design, vendor confirmation is specific to your organization.
In the design, new details need a new confirmation.
Withdrawing a confirmation is a planned capability. It is still being designed.
01 / HOW CONFIRMATION WORKS
The central question is who confirmed the bank details, whether they could act for the vendor, and which organization the confirmation was for. The design addresses four parts.
The design separates proof of identity from authority to act for a vendor. Enrollment controls are still being built and tested with synthetic data; this page does not claim that vendor authority is checked in a live service.
In the design, vendor confirmation is specific to your organization. Confirmation for another organization does not confirm the details for yours.
The design compares your team’s bank details with the details the vendor confirmed for your organization. Before you pay, check saved bank details again. New details need a new vendor confirmation.
Withdrawing a confirmation is a planned capability. Who may withdraw it, how later loss of vendor authority affects it, and the effect of expired enrollment evidence remain under design review.
02 / CURRENT BOUNDARIES
Tests with synthetic data can examine the design. They cannot establish who has access to a live system, how real data is handled, or whether an operating procedure is followed.
MoneyID is in development and is being tested with synthetic data. Production controls need separate deployment evidence and operating records.
A match does not approve a payment. Your team decides whether to pay. Checking saved details again does not send a payment or show that a payment has settled.
03 / OUR PUBLIC WEBSITE TODAY
These protect our website and email. They do not prove that any single message came from MoneyID.
Our website loads only over a secure (HTTPS) connection.
Our website does not load advertising or tracking scripts.
Our email domain publishes SPF and DMARC records, which make it harder for someone to send email pretending to be MoneyID.
We publish a security.txt file so security researchers know how to contact us.
04 / READINESS
Status as of October 19, 2026.
| Area | Status | What this means |
|---|---|---|
| SOC 2 | Readiness in progress | We are preparing controls and evidence. MoneyID does not have a SOC 2 report today. |
| Nacha ACH Rules | Applicability review in progress | An internal review of which rules may apply is drafted. Counsel review of MoneyID’s role is pending. |
| Subprocessor list | Not yet available | A list of service providers that may handle data is not available yet. |
05 / OPERATIONAL DILIGENCE
These questions belong alongside the confirmation design. They are diligence topics, not claims that the controls are deployed today.
What information is collected, why it is needed, where it is processed, how long it is retained, and who can see it. Privacy disclosures and actual data flows need to agree.
Who can access sensitive data, submit new bank details or change a vendor confirmation, how access is granted and removed, and what completed access reviews show. A policy needs evidence that it is followed.
The deployed system boundary, configuration and change records, and third parties that process personal data. A list of software accounts is not a verified subprocessor list.
How concerns are received, triaged and escalated, how affected vendor confirmations are handled, and what an exercised response procedure demonstrates.
06 / CHECK A REQUEST
07 / REPORT A SECURITY CONCERN
No company can rule out every security problem. If you find one, we want to hear about it.
Email contact@moneyid.app. Please do not access or change other people’s data while testing, and don’t send passwords, one-time codes or full bank account numbers.
08 / DOCUMENTS & QUESTIONS
For a security discussion, share the intended use, data involved and your assessment requirements. We can discuss the current product boundary and what evidence your team would need.
Policy
Read the current notice on the MoneyID website.
Read the notice ↗Reporting
How to tell us about a security issue with our website.
Go to reporting ↓MoneyID does not currently offer assurance reports or gated documents.
09 / SECURITY QUESTIONS
No. MoneyID does not currently have a SOC 2 report.
No. MoneyID does not hold, move or send money.
No. In the design, proving who someone is and showing they’re allowed to act for the vendor are separate steps. A verified identity alone wouldn’t be enough to confirm bank details for a vendor. See how this works in our design.
No. In the design, a vendor’s confirmation shows which bank details the vendor wants your organization to use. On its own, it doesn’t prove who owns or controls the bank account. Your team’s own bank-change steps still apply.
Don’t pay or reply. Follow your organization’s bank-change steps, call the vendor at a number you already have, and tell us at contact@moneyid.app without including passwords, codes or full account numbers.
See our privacy notice.
A conversation grounded in scope
Accounts payable, treasury and security teams can talk with us about their bank-detail workflows and the evidence needed to evaluate MoneyID.
Talk with us
