TableCents by Innorve

Vendor due-diligence package

Supports credit-union third-party risk management and ongoing monitoring.
1. Data-flow overview
  • Guardian → hosted co-branded portal (credit-union link, QR or access code). No core-banking, transaction feed or SSO required.
  • Child activity stays inside the guardian's household; credit-union dashboards read aggregate counts only.
  • Facilitators receive minimum-necessary rosters for their own sessions.
2. Privacy practices
  • Data minimization: nickname + age band for children; no birthdate, contact details or financial data.
  • Verifiable guardian consent gates child profile activation; guardians export or delete data in-product.
  • No sale of data, targeted advertising, or use of learning data for credit, lending or marketing.
  • Purpose-linked retention with deletion after inactivity.
3. Security controls
  • Tenant isolation on every query; role-based access for parent, facilitator, curriculum creator, reviewer, CU admin and Innorve admin.
  • Passwords hashed (scrypt); httpOnly session cookies; audit log for consent, publishing, takedown and privacy actions.
  • Encryption in transit (TLS) and at rest via the hosting provider (deployment-specific).
4. Subprocessors
  • Hosting and managed Postgres provider (deployment-specific)
  • Transactional email provider for guardian notifications (planned)
  • No advertising or data-broker subprocessors
5. Incident & takedown process
  • Security incidents: triage, containment, notification to affected institutions per contract.
  • Content: facilitators can quarantine a curriculum item with a high-severity flag; reviewers can unpublish instantly while preserving audit history.
  • Safeguarding disclosures in live sessions follow the facilitator escalation procedure.
6. Accessibility statement
  • Designed toward WCAG 2.2 AA: read-aloud, keyboard navigation, focus management, contrast-safe brand colors, reduced motion.
  • Alternate response methods (tap-to-choose) on every mission step.
7. Insurance & certifications
  • Provided under NDA during procurement (insurance certificates, security assessments).
8. Product boundaries
  • Education, not financial advice, counseling or therapy.
  • No child bank/debit/credit connections; play money only.
  • No unrestricted generative-AI chat for children; AI is used on the creator side with human approval.
  • Curriculum efficacy is not claimed until supported by outcome evidence.
  • NCUA does not approve or certify vendor technology.