Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
You answer for the providers handling customer data. Coverbase helps you oversee them.
The FTC's Safeguards Rule requires non-bank financial institutions to vet, contract with, and monitor their service providers, and since May 2024, to notify the FTC within 30 days of a breach affecting 500 or more consumers. Coverbase runs the oversight side.
CoverbaseFTC Safeguards | provider
FTC Safeguards | provider
The data scope expands
Customer information
Provider safeguards
Contract terms
Agent work
01Read safeguards
02Check the clause
03Assign review
Provider file updated
Your Qualified Individual sees the change.
Who the Safeguards Rule applies to
The rule (16 CFR Part 314), enforced by the FTC under the Gramm-Leach-Bliley Act, applies to non-banking “financial institutions” under FTC jurisdiction, such as mortgage lenders and brokers, finance companies, auto dealers, tax preparers, collection agencies, and certain advisers. Banks and credit unions are overseen by their own prudential regulators.
What the Safeguards Rule asks of you
- 01
Service provider oversight (§314.4(f))
Select providers that can safeguard customer information, require safeguards by contract, and periodically assess them based on risk. - 02
A written information security program
Run a documented program overseen by a designated Qualified Individual. - 03
Risk-based safeguards
Apply controls like access management, encryption, and MFA across customer information. - 04
30-day breach notification
Notify the FTC as soon as possible, and no later than 30 days, after discovering a breach affecting 500 or more consumers.
Make service-provider oversight a standing process
The rule names three things: pick capable providers, contract for safeguards, and reassess by risk. Coverbase supports all three as a standing process.
Provider assessments, automated
Vet and reassess service providers based on the risk they present.Safeguard clauses tracked
Confirm provider contracts require the safeguards the rule expects.Breach-ready records
Keep provider facts on hand for the 30-day FTC notification clock.Program documentation
Give your Qualified Individual the evidence to oversee the program.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
Safeguards Rule provider questions
Check jurisdiction and the event definition before applying a clock.
Does the FTC rule apply to banks and credit unions?
Generally no. The FTC rule applies to institutions under FTC jurisdiction; banks and credit unions have their own regulators and safeguards requirements.
Is every data breach reportable within 30 days?
No. The FTC threshold is a defined notification event involving at least 500 consumers' unencrypted information. Encrypted information counts if the encryption key was also accessed without authorization.
Do you replace our Qualified Individual?
We connect provider assessments, contracts, and changes. Your institution and its Qualified Individual own the security program and any required notice.