A bank's vendor-risk reviewer reads the homepage, the Compliance & Governance page and the Customer page side by side, and today they say different things. The homepage shows a "SOC 2 Type II Certified" badge. The Compliance & Governance page says Proximitty "is currently in accordance of all SOC 2 principles" and never mentions Type II, an audit report or GLBA. The go-live promise also changes: "in 3 weeks" with a week-by-week plan on the homepage, "under two weeks" on the same homepage and on the Customer page, and "within a week" in the only testimonial. Every mismatch turns into a diligence question, and it slows the deal while a two-person team answers it.
First action
List every compliance and timeline claim on the homepage, /security and /customer, and mark the accurate wording for each.
How to measure it
Demo-to-pilot cycle time
- Now
- –
- Target
- -25%
- By
- 90 days
Steps
Inventory the claims
Every SOC 2, GLBA, timeline and accuracy statement across the homepage, /security, /customer, /company and the Trust Center, in one sheet.
Co-Founder & CEO 2 hours
Confirm the facts
Report type, audit period and auditor letter for SOC 2; what the GLBA badge refers to.
Co-Founder & CTO 1 day
Pick one timeline
Use the median sandbox and production dates from recent deployments; write one definition.
Co-Founder & CEO 1 day
Rewrite the pages
Same words on every page; badge text matches the report.
Co-Founder & CEO 1 day
Add the diligence block
What a bank can request, how, and how fast, on /security.
Co-Founder & CTO 2 days
Fill the Trust Center
List the same documents with a request flow, so the footer link and the page agree.
Co-Founder & CTO 2 days
Log diligence questions
Record each question per deal and add the common ones to the page.
Co-Founder & CEO ongoing
Why it works
Agree one accurate statement for each claim and use it everywhere. SOC 2: give the report type, the audit period and how a bank can get the report (for example under NDA through the Trust Center). If an audit is still in progress, say so plainly with the expected date, and change the badge to match. Go-live: pick one number with a definition, such as "sandbox in week 1, production by week 3", and present the faster testimonial as an example, not the promise. Then add a short "Vendor due diligence" block to the Compliance & Governance page listing what a bank can request (the SOC 2 report, GLBA safeguards summary, model cards, validation artifacts, examiner support) with one request button that goes to a founder.
Community banks and credit unions run a third-party risk review before any pilot. Consistent, specific claims answer the reviewer's first questions before they're asked. Competitors already set the bar: Aloan and EnFi both state SOC 2 Type II plainly, and Aloan links to a Trust Center.
Ready to use
ChecklistClaim consistency checklist
[ ] One SOC 2 sentence (type, period, how to request) on homepage, /security and Trust Center [ ] Badge text matches that sentence [ ] GLBA badge explained in one line [ ] One go-live definition (sandbox / production) on homepage, /customer, /company [ ] Testimonial shown as an example, not the promise [ ] Vendor due diligence block with request button [ ] Documents listed: SOC 2 report, GLBA safeguards summary, model cards, validation artifacts, examiner support [ ] Date each page was last reviewed
Risks and how to handle them
A slower, accurate timeline feels less exciting
Lead with sandbox in week 1 and keep the one-week testimonial as an example.
Wording that still overstates the audit status
Have the auditor or a compliance adviser read the final SOC 2 sentence.
Evidence
- Your websiteHomepage: H1 "The AI operating system for commercial lending"; a "SOC 2 Type II Certified" badge and a GLBA badge next to "Trusted by credit unions and banks across the US"; "Integrate Proximitty with any banking system in 3 weeks" (Week 1 Integration, Week 2 Sandbox Testing, Week 3 Deploy) on the same page as "Most integrations go live in under two weeks."; Request Demo is the only call to action.Source
- Your websiteCompliance & Governance page (H1 "Regulator-grade governance by design"): "Proximitty is currently in accordance of all SOC 2 principles", followed by tenant isolation, encryption and no training of shared models; agents are "SR 11-7 aligned by design"; model cards, validation artifacts and challenger testing materials are available on request; "Our subject matter experts are available during examinations at no additional cost." The page does not mention Type II, an audit report or GLBA.Source
- Your websiteCustomer page: H1 "Trusted by FDIC-insured commercial banks and fintechs"; "From top-20 banks to high-growth fintechs"; one testimonial, from an unnamed "SVP Credit Risk, Fintech Lender": "They built agents running on our internal systems within a week without any engineering involvement from our side"; "Most integrations go live in under two weeks"; no named customers or case studies.Source
- Competitor researchAloan (AI commercial loan underwriting for community banks and credit unions) names five bank and credit union customers, shows 5.0 reviews across Gartner Peer Insights, G2, Capterra and SourceForge, publishes comparison pages against nCino, Abrigo, Baker Hill and manual spreading plus buyer's guides, states a 2-4 week go-live, and lists SOC 2 Type II with a Trust Center.Source