Most applications that never finish were already decided. Cotribute closes the gap between a decided applicant and a funded account.
Summary from the company’s website.
Publicly advertised compliance posture
As observed on September 8, 2026 on the organization’s public trust center.
-
SOC 2
Independent CPA audit of controls for security, availability, and confidentiality.
Compliance timeline
-
September 8, 2026
Posture last observed by Trust Index
Subprocessors
Third parties Cotribute discloses on its trust center. Linked entries have their own profile in the Trust Index.
50% chain trust: 16 of 32 disclosed subprocessors are themselves in the Trust Index.
- Amazon Web Services Infrastructure hosting
- Heroku Application and database hosting
- Vercel Application hosting and delivery
- Snowflake Data warehouse
- Anthropic Generative AI content
- Appcues In-application guidance
- Bitwarden Password management
- Checkr Employee background screening
- Cloudinary Media hosting
- CloudSponge Contact list import
- Customer.io Transactional and lifecycle email
- GitHub Source code management
- Google Workspace Corporate email, storage and staff identity
- IPQualityScore Device and contact risk scoring
- MicroBilt Alternative credit data
- Middesk Business identity verification
- Netlify DNS hosting
- New Relic Application performance monitoring
- OpenAI Generative AI content
- Papertrail Log aggregation
- Plaid Bank account and identity verification
- QuotaGuard Network egress proxy
- Segment Customer data pipeline
- Sentry Error monitoring
- Sigma Embedded analytics
- Sinch Mailgun Email delivery
- Socure Identity verification and fraud decisioning
- Stitch Data pipeline
- Supabase Database and file storage for growth products
- Twilio SMS and one-time passcode delivery
- Twilio SendGrid Email delivery of one-time passcodes
- Vital4 Sanctions and watchlist screening
About this data
The Trust Index reports only what organizations publicly advertise. A missing framework here means no public claim was observed as of September 8, 2026; it never means an organization is non-compliant. HIPAA entries reflect a public claim of compliance; no HIPAA certification exists. Corrections are welcome and verified against public evidence. Read the full methodology.
