Security and Compliance FAQs

Chimney is build to the highest performance and security standards. Here's a collection of common FAQs about our technology:

Chimney completes an annual, independent SOC 2 Type II audit to confirm that our security, availability, and confidentiality controls meet strict industry standards. It’s one of the many ways we make sure your data is consistently protected. ‍

No, the only network requests we make are to track page views and sessions for analytics. We don’t send any PII or other data over the network. The JavaScript embed code is hosted by us and adds the HTML elements to the DOM, which render the calculator.

Yes, the embed code comes from a single file hosted on a Heroku server with transport security via TLS/SSL and Automated Certificate Management, located in the United States region. TLS 1.1 and TLS 1.1 are not enabled. We only have TLS 1.2 enabled, per PCI compliance best practices.

No. Our calculators do not capture, store, or transmit any personally identifiable information (PII).
The only data collected is anonymous session and page-view analytics.

Chimney Home collects minor, non-sensitive PII when required for product functionality. This includes:

All PII collected for Chimney Home is protected under our SOC 2 Type II controls, encrypted in transit and at rest, and never shared with third parties.

We work exclusively in financial services with dozens of highly regulated financial institutions, our customers typically fit in one of four industries.

For legal reasons, we do not actively disclose a full list of our clients are, but we host calculators for several fortune 1000 financial brands.

‍We're actually already using TLSv1.2. If you curl our embed code server, you'll see all of the security and encryption details in the TLS handshake curl -vI https://embed.signalintent.com