Security and multi-factor authentication

Turn on MFA before you use Bancroft with client information. This article explains the account protections and what to do if an account may be compromised. For a firm’s vendor review, see Security.

Encryption

Connections use HTTPS. The platform also uses the following controls:

• Database: encrypted storage, hosted in the United States.
• Digital Safe files: AES-256-GCM envelope encryption with a separate key for each entry. Storage administrators cannot read vault files without encryption keys managed by Bancroft.
• MFA secrets: encrypted with AES-256-GCM before storage.
• Passwords: stored only as salted one-way hashes. Bancroft never stores plaintext passwords.

Multi-factor authentication

Multi-factor authentication adds a second check beyond your password. It is available on every account, for advisors and clients, and works with any authenticator app: Google Authenticator, Authy, 1Password, Microsoft Authenticator or similar.

Sessions

Sessions renew while you work and end after a set limit, so you may be asked to sign in again during a long day. The questionnaire saves as you go. Security-sensitive changes, such as a password change, sign the account out on every device.

Sign-in protection

Repeated failed sign-in attempts cause a temporary lockout. Follow the message on the sign-in screen, or contact support if you cannot regain access.

Household access

Access checks use account roles, firm membership and household assignments. Request security documentation from support@usebancroft.com if your vendor review needs more detail.

What to do if you suspect unauthorized access

1. Change your password right away. This signs the account out on every device.
2. Check your recent activity for anything you do not recognize.
3. Turn on MFA if it is not already on.
4. Email support@usebancroft.com with the details. We can review sign-in history and take further protective steps.