What we do to protect your banking details.
Veiled Wire exists to keep wire instructions out of the inbox. This page lists what we do, and which independent audits our services hold. We keep it honest, because security claims should be.
Built in from the start.
Encrypted, with the key kept apart.
Banking details are encrypted with AES-256 before they are stored. The key lives in a separate key-management service never in our database or in the link.
Verified before anything is shown.
Your customer must enter a one-time code sent to their phone by text, or by voice call on Veil Unlimited, before the details are decrypted.
One use, then erased.
The link opens once and expires after 72 hours. The encrypted banking details are erased as soon as they are viewed, or when the link expires unopened.
Two-step sign-in for senders.
Senders sign in with a password and a code from an authenticator app, with backup codes available. Sign-in and code attempts are rate-limited.
Five separate systems.
The key vault, database, email service, SMS and voice verification, and web server are run by different companies, so no single provider holds the full picture.
A record without the secrets.
Our activity log shows when an instruction was sealed, when a code was sent, and whether it was approved, denied, viewed or expired. It never contains banking details.
Attached PDFs are checked and encrypted.
On Veil Unlimited, an attached PDF is checked for scripts and other active content, encrypted with its own key, available only after verification, and deleted when the link expires. An optional antivirus scan can be added.
Hardened web protections.
The site is served only over HTTPS with HSTS, a Content Security Policy that allows only our own scripts, protection against being framed by other sites, and no-cache rules on sensitive pages. Secure links are kept out of search engines.
No advertising trackers.
We do not use advertising or tracking cookies, and we load no third-party analytics on the pages that handle banking details.
Typo and bot protection.
US routing numbers are checked for typos before anything is sent, and a bot check protects sign-up.
Our website, graded by independent scanners.
These free, public tools test the security settings of veiledwire.com. Run them yourself at any time.
Built on services with independent audits.
Veiled Wire runs on established services. These are their audits and certifications, not ours, as published by each provider.
| Service | Certifications |
|---|---|
| Database and sign-in | SOC 2 Type 2 report (annual audit) |
| Encryption key management | SOC 2 Type II and ISO 27001 coverage, as reported by the provider |
| Web hosting | SOC 2 Type 2 and ISO 27001 |
| Email delivery | SOC 2 Type II |
| Text and voice verification | Security and compliance documents published in a public trust center |
| Payments (merchant of record) | States that it follows PCI and GDPR requirements. Card details never reach Veiled Wire. |
Source: each provider’s own published compliance documentation.
Questions from your security or compliance team? Write to support@veiledwire.com. To report a security concern, use the same address and put “Security” in the subject line.