Security at Betterment: How we protect advisors and clients

As an advisor, you entrust your custodian with highly sensitive client information, critical workflows, and the movement of client money. That makes security diligence more than a box to check—and “we take security seriously” only gets you so far. The questions worth asking are concrete: What independent evidence is available? How is information protected? How does the custodian prepare for disruption, and what actually happens when something goes wrong?

So, let’s get into it. Here’s a quick guide to how Betterment approaches each of these.

Betterment makes current diligence materials available through its Trust Center. For advisory firms, the most relevant items are the Betterment Securities SOC 1 Type II report, which tests controls in areas such as custody and trading, and the SOC 2 Type II report, which covers our security program. The Trust Center also carries bridge letters, a completed SIG questionnaire, the Information Security Policy, the Risk Management Framework, and business continuity documentation, along with a standard due diligence packet for advisors that answers many of the questions firms most often ask about.

In other words, you don’t have to take our word for it. You and your compliance team can evaluate Betterment's controls using independent reports and documented evidence of how the program actually works. Sensitive materials are distributed through a controlled portal and may require a click-through NDA.

Betterment operates a formal cybersecurity program built around confidentiality, integrity, and availability. That translates into some practical safeguards: least-privilege access, role-based access controls, multi-factor authentication requirements, periodic access reviews, and controls for remote access.

Non-public information is encrypted at rest, and information transmitted to Betterment services is protected in transit using TLS 1.2 or higher. Betterment also maintains data-classification and key-management practices, because not all information carries the same risk—and the safeguards should reflect that.

Of course, prevention is only part of the job. You also need to understand what’s happening when something looks off. We consolidate security events from systems across the business to monitor them. The monitoring is supported by a managed security services provider (MSSP) that operates 24/7, with security engineers on call as needed.

If an incident does happen, there’s a playbook that covers detection, investigation, notification, remediation, coordination with law enforcement and insurers where relevant, and post-incident analysis. The program is designed to meet the requirements of SEC Regulation S-P as amended, including timely notice of breaches involving customer information.

We perform annual cybersecurity risk assessments using the NIST Cybersecurity Framework. Results are reviewed by an executive-level risk committee. Independent testing includes annual SOC examinations and periodic third-party penetration testing.

We also plan for the less significant, but still disruptive, things that could go wrong by maintaining business continuity and disaster recovery plans. Recovery targets are informed by business-impact analysis, key third parties are considered in resilience planning, and recovery plans are tested annually.

In general, custody and financial services rely on a wider ecosystem of technology and service providers. Betterment's third-party risk-management program includes due diligence before onboarding and ongoing monitoring. The program is designed to assess security, operational resilience, and other risks introduced by important external relationships.

If you’re doing security diligence on Betterment, the easiest place to begin is the Betterment Trust Center. Just request access with your work email, and you will be directed to the correct materials. There, advisors, prospects, or compliance officers can review our security system. If your firm needs something that is not in the portal, just ask. Your relationship manager can coordinate with the Risk and Information Security team to send you the materials you need.

Are my clients' assets protected by SIPC or FDIC?

Betterment Securities is a member of the Securities Investor Protection Corporation (SIPC), which protects securities customers of its members up to $500,000 (including $250,000 for claims for cash). Explanatory brochure available upon request or at www.sipc.org.

Who is Apex Clearing, and why do my clients receive correspondence from them?

Betterment Securities is the carrying broker-dealer for advised client accounts, and Apex Clearing Corporation provides clearing services. Apex executes and settles trades through an omnibus arrangement with Betterment Securities, which is why certain regulatory notices and confirmations reference Apex. Clients can treat correspondence from Apex about their Betterment account as legitimate, and they can always verify it with their advisor or with Betterment support.

How does Betterment prevent fraudulent withdrawals and account takeover, and what happens if fraud occurs?

Betterment uses layered controls so that a stolen password or a compromised email account is not enough to move client money. Two-factor authentication is mandatory for every login. Withdrawals pass through automated risk checks that look at factors such as recently added bank accounts, recent profile changes, and unusual characteristics, and can hold a transaction for verification before funds leave. Betterment's fraud operations team investigates suspected unauthorized activity, works with the receiving institution to recover funds where possible, and coordinates with the advisor through the firm relationship. If an account is restricted during an investigation, the advisor's Betterment contact can help prioritize time-sensitive client needs.

Could a compromised advisor email account be used to move client money?

No. Email instructions alone do not authorize money movement, bank-account changes, or account-level changes on the Betterment platform. Those actions take place inside authenticated sessions on the advisor dashboard or the client's own account, each protected by two-factor authentication. Withdrawals are subject to the same risk checks described above. Requests that come to Betterment support by email or phone are verified before any sensitive change is made.

How does two-factor authentication work for advisors and their clients?

Two-factor authentication is required on every Betterment login. Clients can receive codes by text message, phone call, or an authenticator app, and can ask Betterment to remember a trusted device to reduce repeat prompts. Advisor dashboard logins require two-factor authentication as well. Each advisor and staff member should have their own login rather than sharing one. Firm admins can manage users, and Betterment support can reset two-factor settings after verifying the requester's identity.

Will Betterment notify my firm if client information is involved in a security incident?

Yes. Betterment's incident response program includes a process to give affected clients and partners the information they need to prevent or reduce harm, taking into account regulatory and contractual timelines, including the Regulation S-P requirement to provide timely notice of breaches involving customer information. Firms that need the incident response policy or breach-notification procedures for their own Regulation S-P files can find them in the Trust Center due diligence packet.