Every Sascu digital banking session runs through multiple independent security layers — encryption, authentication, monitoring, and guaranteed liability protection — so you can manage your money without second-guessing the safety of the connection.
Encryption Standards and Data Protection
Sascu secures every online and mobile banking session with Transport Layer Security (TLS) 1.3 using 256-bit encryption keys. When you visit the Sascu online banking login page, your browser and our servers establish an encrypted tunnel before any account data moves across the network. This is the same cryptographic standard used by federal financial regulators and defense contractors. The encryption handshake completes in milliseconds, so there is no perceptible delay during login, but the protection is absolute — intercepted packets contain nothing an attacker can read.
Behind the login screen, all account data resides on servers in geographically distributed data centers with biometric access controls, twenty-four-hour armed security, and redundant power systems. Database records are encrypted at rest using AES-256. Access logs record every administrative query against the database, and those logs are reviewed weekly by an independent security audit team. For background on federal encryption guidelines for financial institutions, consult fdic.gov.
Multi-Factor Authentication
Passwords alone are not enough. Sascu requires multi-factor authentication for every login from an unrecognized device and for all transactions above $500. After entering your username and password, the system sends a one-time verification code to the phone number or authenticator app registered to your account. That code expires in ten minutes and cannot be reused. If someone obtains your password through a data breach at another service — and credential stuffing attacks are the most common vector for account takeover — they still cannot access your Sascu account without the second factor.
Account holders can choose between SMS delivery, an authenticator application like Google Authenticator or Authy, or a hardware security key that plugs into a USB port. SMS codes work for anyone with a mobile phone. Authenticator apps generate codes offline and are immune to SIM-swap attacks. Hardware keys provide the strongest protection and are recommended for business accounts that process wire transfers or ACH batches above $10,000.
Fraud Monitoring Systems
Sascu runs real-time transaction surveillance on every account, every second of the day. The monitoring engine analyzes transaction patterns — location, amount, merchant category, time of day — against each account holder's historical behavior. A debit card swipe at a gas station in Charlotte followed three minutes later by an online purchase shipping to an address in a different state triggers an automatic alert. The system does not simply flag the transactions; it can freeze the card and push a notification to the account holder's phone within fifteen seconds of detection.
The monitoring algorithms adapt over time. If you regularly travel between two cities for work, the system learns that pattern and stops flagging legitimate cross-city transactions. If your business typically processes payroll on the twenty-eighth of each month, an out-of-cycle payroll run prompts a verification call before the ACH file is released. False positives happen occasionally, and they are resolved with a two-minute phone call rather than a paperwork ordeal.
| Security Feature | Specification | Coverage Detail | Account Holder Action Required |
|---|---|---|---|
| TLS Encryption | 256-bit, TLS 1.3 | All browser and app sessions | None — automatic |
| Multi-Factor Authentication | SMS, authenticator app, hardware key | Unrecognized devices, transactions over $500 | Enroll phone or app in account settings |
| Real-Time Fraud Monitoring | Behavioral analytics, 24/7 operations center | Every debit, ACH, wire, and online transfer | Keep contact phone current |
| Liability Protection | $0 unauthorized transaction liability | All personal deposit accounts | Report unauthorized activity within 60 days |
| At-Rest Encryption | AES-256, encrypted database storage | All stored account records | None — infrastructure-level |
Customer Protection Guarantee
Sascu guarantees zero liability for unauthorized transactions on personal deposit accounts, provided the account holder reports the activity within sixty days of the statement date. This is not a marketing promise buried in fine print. The guarantee is written into the deposit agreement, and the reimbursement process does not require the account holder to prove they were not at fault — the investigation starts from the assumption that the transaction was unauthorized, and the burden of proof sits with the institution.
For business accounts, the guarantee applies to consumer-style transactions — debit card purchases and online transfers — but commercial wire fraud follows a different framework. Business clients who process wires should enroll in dual-approval controls and positive pay services, both of which Sascu offers at no additional cost. For more detail on consumer financial protections, visit consumerfinance.gov.
Privacy Practices
Sascu does not sell customer data to third parties. Transaction history, account balances, and personal identification information stay inside the institution unless a customer explicitly authorizes sharing through an account aggregation service or third-party financial app. The privacy notice — updated annually and mailed to every account holder — lists every category of third party that might receive information (credit bureaus, check printers, card processors) and the specific data each receives. Marketing partners receive only aggregated, anonymized demographic data that cannot be traced to an individual account.