Built on trust.
Backed by security.
You hold your members' trust. Here's exactly how Lobby protects your credit union's work: what we built, and what we built it on.
Getting in takes two steps. Every time.
Two-step sign-in, every time
An emailed six-digit code plus an authenticator app. No passwords to share or forget.
The sign-in page keeps quiet
Every email address gets the same answer in the same time, so nobody can use it to learn who has an account.
Staff can't sign in as you
SmartSource staff work in their own tool; staff accounts are refused at Lobby's sign-in.
Removing someone is immediate
It ends every session they have and blocks their next sign-in.
Everyone sees only what they should.
Every page checks first
A verified two-step session, an active account, Lobby switched on for your credit union, and access to that room. If any check fails, nothing shows.
Your credit union, walled off
Another credit union's address returns "not found", never confirming it exists.
Roles that match your team
Admins invite, remove and choose what each person sees; Members see what they're given; approvers sign off on posts. The last Admin can't remove themselves.
Staff views are read-only and recorded
"View as client" opens a read-only preview through a signed link that lasts 10 minutes, and every opening is logged.
A record for your examiners.
Every invite, removal, role change and access change is written to a history that can't be edited.
Who did it
A member of your team or SmartSource staff.
Who it happened to
The person invited, removed or changed.
What changed
The role, the rooms they can see, or their access as a whole.
When
The moment it happened, kept with every entry.
Your files and your AI stay yours.
Files are checked before they're stored
Type and size are checked on the server, and images by their actual contents, not their file name.
Private storage, short-lived links
Your files are never public; downloads use links that expire.
AI that stays in its lane
It runs on Amazon Bedrock inside SmartSource's own AWS account, in the Ohio region. AWS states that Bedrock doesn't use your prompts or results to train models.
Providers your examiners already know.
Each of these providers publishes a SOC 2 Type 2 report.
Vercel
Hosting, with HTTPS everywhere.
Supabase
The database, encrypted at rest and in transit.
Amazon Web Services
AI through Amazon Bedrock.
Cloudflare Turnstile
Keeps bots off our forms.
Questions from your examiner?
We'll walk your team and your compliance people through how Lobby works.