Customer files that never reach a third party
The Safeguards Rule reaches much further than banks. If you broker mortgages, service accounts, collect debts, advise on investments or prepare returns, you are a financial institution under it — and the paperwork you handle every day is exactly the “customer information” it names.
The FTC Safeguards Rule, 16 CFR Part 314
Covered firms must “develop, implement, and maintain an information security program with administrative, technical, and physical safeguards designed to protect customer information” — written down, and proportionate to the size of the business and the sensitivity of what it holds. The Rule defines customer information as any record containing nonpublic personal information about a customer, “whether in paper, electronic, or other form”, and it covers records other institutions passed to you as well as your own. Section 314.2(h) lists thirteen worked examples, including mortgage lenders and brokers, account servicers, collection agencies, credit counselors, tax preparation firms and investment advisers who need not register with the SEC. Section 314.4 then sets out nine required elements, one of which is overseeing your service providers. A tool that never receives the document is the one place in that programme where there is no provider to oversee.
The everyday jobs
Where we can’t help
- These are document tools. They are one control inside a written information security program, not the program — Section 314.4 asks for eight other things we cannot do for you.
- Redaction removes what you select. It cannot know that a reference number elsewhere in the file identifies the same customer.
- We keep no record of what you processed, which is the point and also means we cannot produce an access log if your program expects one.
- Office conversions and OCR run on our servers and are labelled on their own pages. Treat those as you would any service provider.
Your toolkit
The 12 tools this work actually reaches for, out of 80.
Open the Network tab and redact one document. The absence of a request is the whole argument.
Redact a documentAlso written for