Security & Architecture
Security that never clocks out.
- Industry standards firstFirewalls, two-factor sign-in, encryption, audit trails and independent pen tests.
- AI add-ons, your choiceOptional, and highly recommended against AI-driven attacks.
- Your staff decideAnything suspicious is on the case before a payout is approved.
- Members barely noticeTwo-factor sign-in, or a face or fingerprint passkey, and extra checks only when something looks wrong.
Why now
Pension benefits are a target.
- The payout is the prizeFraudsters change a member's address or bank details, then redirect the monthly pension or take a lump sum or refund.
- Attacks run on autopilotBots try stolen passwords at scale, and AI writes the phishing emails and clones the voices.
- Scrutiny is risingRegulators, auditors and courts are asking how plans protect participant data.
Our approach
Industry standards first. AI on top.
- A web firewall and bot screening at the edge
- Two-factor sign-in as standard, passkeys as an option, and risky sign-ins asked for more proof
- Passwords from known breaches refused
- Encryption in storage and in transit, on private networks
- Every action on the record, and every security alert in one place
- Independent pen tests, as often as your service agreement requires
- Suspicious activity flagged on the case for the staff member approving it
- AI pen tests every quarter
- AI security agents that watch around the clock and investigate each alert
- Each finding summed up on the case for your staff, and the full investigation sent to your security contact
- Typing-rhythm, mouse and touch checks
- Our chatbots and AI agents watched for prompt injection and misuse
Pen testing
Independent pen tests, plus AI every quarter.
A year of pen testing
The usual way, one pen test a year leaves months of changes untested. With the AI add-on, AI agents test every quarter, and independent testers test as often as your service agreement requires.
Timing is illustrative. Independent pen tests run as often as your service agreement requires.
- Independent testersHuman pen testers on a regular schedule, as often as your service agreement requires.
- Proven, not guessedAI add-onEach AI finding is confirmed by an actual exploit, so your team isn't chasing false alarms.
- The fix comes with itAI add-onEach AI finding arrives with a recommended fix for your team to review.
- Board-ready reportsSeverity scores and remediation for every test, mapped to common security frameworks.
Fraud detection
Know it's really them.
Try it: your typing rhythmAI add-onType this phrase: my pension is mine
The member's usual rhythm has uneven gaps between keys. A bot's gaps are all the same length.
Start typing and your rhythm appears above.
This demo runs only in your browser. Nothing you type is sent or kept.
- Device and placeA new device in a new place is asked for more proof.
- Stolen passwordsPasswords from known breaches are refused at sign-in and sign-up.
- Fake accountsBots can't mass-register accounts in your member portal.
- Fraud ringsAccounts that share a bank account, device or address are linked and flagged.
- Typing rhythmAI add-onSpots the right password typed the wrong way.
- Mouse and touchAI add-onTells a person from a bot or a remote-control scam.
Only the timing and movement of keystrokes, taps and clicks are measured, never what members type.
Alert to decision
Your staff see what security sees.
- Each finding says what was found, with a suggested check, such as calling the member on the number already on file.
- With the AI add-on, an AI security agent investigates in minutes and sums up the attack on the case.
- The reviewer, a supervisor or your security contact can be alerted, and your security contact gets the full investigation.
- Your security team also sees threats, weaknesses and misconfigurations ranked together on one screen.
- Your staff member decides, and the decision goes on the record.
Lump-sum payout requestWaiting for your approval
- Submitted
- Member portal
- Pay to
- New bank account
Security findingsHigh risk
- Submitted from a new device
- New sign-in method added this week
- Typing rhythm didn't match the member's usualAI add-on
- Bank account changed this week
- Same bank account as another member's record
AI security agentAI add-on
Likely account takeover. This session doesn't match the member's usual device, place or typing rhythm.
Full investigation sent to your security contact.
Suggested check: Call the member on the number already on file before approving.
Your staff member decides, and the decision goes on the record.
Commitments
Five commitments, with the proof for your board.
Rules run before the model
Topics you restrict, escalate or redirect get your approved wording before a model runs.
AI proposes. Staff decide.
Nothing changes until a person with permission confirms, and that person is on the record.
Sensitive identifiers are withheld from the model
Social Security numbers, dates of birth and bank and account numbers are never read from records for the AI model, and typed ones are screened out before the model call.
Your data isn't used to train AI models
PensionID doesn't use your documents, member data or conversations to train AI models.
Every AI feature carries a label
Each label says what the feature can see, what it can't see, whether it can act and where the model runs.
- Security summariesWhat was tested, found and fixed, on the schedule you set.
- Pen test reportsA report for every test, ready for your auditors.
- Audit trailEvery action on the record.
- Incident playbooksSteps, owners and contacts agreed in advance.
What clients ask
Is the AI required?
No. PensionID is built on industry-standard security, and the AI add-ons are optional. We highly recommend them, because attackers now use AI too.
Does AI pen testing replace independent pen testing?
No. Independent pen testers still test the platform on a regular schedule, as often as your service agreement requires. The AI add-on adds a test every quarter in between.
Do the AI security agents act on their own?
No. They investigate and inform your admin staff and your security contact. Your staff decide what happens next, from approving a payout to applying a fix.
Can AI fake a member's face to sign in?
No. With a passkey, the face or fingerprint check happens on the member's own phone and never reaches us. What signs them in is a key kept securely on that phone, which a deepfake can't copy. And if someone adds a new sign-in method to an account, it's flagged on the next payout request.
Do you record what members type?
No. Only the timing and movement of keystrokes, taps and clicks are measured, never what members type.
Will this slow members down?
No. The checks run in the background, and members are asked for more only when something looks wrong.