Security
DiscoFi moves other people’s money to people who are not its customers, so the controls that matter are the ones around who can send, what gets screened, and what is written down. Deposits and payment execution sit with a chartered bank partner; DiscoFi is the software layer on top of it.
Banking services provided by FinWise Bank, Member FDIC. Skyward Labs, Inc. is a financial technology company, not a bank.
The money sits with a bank.
Payout funds are held and payments are executed through FinWise Bank, Member FDIC. That is the single most load-bearing fact on this page, and it is the reason the rest of it is short: the regulatory perimeter around the money belongs to a chartered institution that is examined for it, not to a startup that wrote its own.
What that arrangement is and why it exists is worth understanding before you sign anything, so it is written up in plain language: what a sponsor bank is.
Four controls, in the order they apply.
- Verified before the first payoutAn organization completes KYB before it can send: business formation documents, EIN, and identity verification for beneficial owners. Bank accounts are linked through Plaid rather than by typing account and routing numbers into a form.
- Screened at the paymentSanctions screening and transaction monitoring run inside the send flow rather than as a report someone reads afterwards, and a payment that raises a flag is held rather than sent.
- Recorded as it happensEvery payout writes double-entry ledger entries and an audit trail. The record of what was calculated, what was approved, what was sent and what came back is one record, not four systems that have to be reconciled to each other.
- Approved by a personMoney moves on an approval, and the approval is stored against the payouts it authorized. Who released a batch is part of the batch.
The screening step is the one most often misunderstood, so it has its own guide: OFAC screening for mass payouts.
The product is not a public surface.
The dashboard, onboarding, sign-in and the admin panel are gated at the edge, before any page renders. An anonymous request to one of those addresses is redirected to a sign-in screen rather than served a page shell that then hides itself once JavaScript runs. The difference matters: the second version returns 200 to anything that does not execute scripts.
A recipient never signs in at all. They open a private link that is unique to their payment and is deliberately excluded from search engines and from the sitemap.
Data we go out of our way not to collect.
Product analytics are restricted to what a screen was, whether a step succeeded, and how many of something there were. Names, emails, phone numbers, addresses, dates of birth, SSNs, ITINs, EINs, account and routing numbers, passwords and tokens are on a forbidden list, and a value that merely looks like an email address or an SSN is blocked whatever the field is called.
This is enforced in code rather than in a policy document. The guard throws during development the moment a forbidden value is attached to an event, so a leak fails loudly at the point someone writes it instead of quietly for months afterwards.
Common questions.
Where does payout money actually sit?
With FinWise Bank, Member FDIC. Skyward Labs, Inc. is a financial technology company, not a bank, and does not hold deposits itself.
Who can move money in a DiscoFi account?
Only a verified organization that has completed KYB and whose beneficial owners have been identity-verified, and only through an approval that is recorded against the payouts it authorized.
Does a recipient need a DiscoFi account to be paid?
No. A recipient is paid to the bank account they already have, through a private claim link that is unique to that payment.
Is the product surface public?
No. The dashboard, onboarding, sign-in and admin panel are gated at the edge, before any page renders. An anonymous request to one of those addresses is redirected rather than served a shell.
Questions from your security team?
Send them to hello@trydiscofi.com and they will reach someone who can answer them properly rather than a form.