Organisation
Institution nameFirst Community Bank
Primary contactDana Whitfield
Contact emaildwhitfield@firstcommunity.bank
RegionUS-East (bank data center, Springfield)
Deployment mode
The bank documented on-premises. Either shape can be previewed.On-Premises
Runs inside the bank’s data center.
SaaS
Hosted by SmarterFI, with schema-per-tenant isolation.
Previewing a shape changes the labels on the landscape diagram and the chip in the page header. It does not change a figure — the record says on-premises, and every score, volume and requirement on this site is read from the record.
Documented controls
Multi-factor authenticationEnforced organisation-wide through Microsoft Entra ID over SAML 2.0.Evidenced by: Environment & security, step 5 of the captureEnforced
No values in the exported packageThe package carries names, systems, counts, methods, scores and criteria. There is no field in it that could hold a customer, account or transaction value — which is checkable by reading the payload rather than by trusting this row.Evidenced by: The structured payload on the outputs pageBy construction
Read-only database scanningThe documented profile carries *USE authority and no *CHANGE, so it cannot write — an ordinary arrangement a bank can verify in its own change record. This build has no database driver and ran no scan, so the denial in the log is a written-down record rather than a session this build performed.Evidenced by: Audit log, 09:52:06 — a recorded line, not a captured eventDocumented, not demonstrated
Audit logging of discovery actionsEvery entry carries an actor, an action, the object it acted on, an outcome, a date and a time — as fields, so a request scoped by actor or by object is a query rather than a reading exercise. What this build demonstrates is that shape; the entries themselves are written down.Evidenced by: Audit log on the scan pageShape demonstrated
Bank review before results are usedOne discovered schema was redacted at review by Risk & Compliance and is withheld from the export package entirely — not by name, count or volume. The package reports fewer tables than the scan enumerated, and that difference is this control.Evidenced by: Audit log, 10:07:02, and the withheld note in the packageApplied
Live data movement (ETL)No pipelines have been defined or approved for this institution.Evidenced by: Integration register, step 4 of the captureNone approved
Data agreement covering the shared copyThe fifth step of the mapping would send a copy of the package to SmarterFI. What governs that copy — retention, permitted purpose, withdrawal — is not in place, which is why the step is open and nothing on this site shares anything.Evidenced by: Mapping progress, step 5 of 5Not in place
Team access
Dana Whitfielddwhitfield@firstcommunity.bankOwner · SVP Operations
Marcus Reyesmreyes@firstcommunity.bankEditor · IT Director
Priya Nandakumarpnandakumar@firstcommunity.bankApprover · Risk & Compliance
Alan Petrakisapetrakis@firstcommunity.bankApprover · BSA Officer
Renée Duclosrduclos@firstcommunity.bankViewer · Internal Audit
Attestation and review
Who answered each section, when, and when it falls due again.Record due 5 Aug 2027| Section | As of | Attested by | Review by | Cycle |
|---|---|---|---|---|
| Institution profile | 5 Aug 2026 | dwhitfield@firstcommunity.bank | 5 Aug 2027 | Annual |
| Core & ancillary systems | 5 Aug 2026 | mreyes@firstcommunity.bank | 5 Feb 2027 | On every core release |
| Data domains | 5 Aug 2026 | mreyes@firstcommunity.bank | 5 Aug 2027 | Annual |
| Integration register | 5 Aug 2026 | mreyes@firstcommunity.bank | 5 Feb 2027 | Semi-annual |
| Environment & security | 5 Aug 2026 | pnandakumar@firstcommunity.bank | 5 Aug 2027 | Annual |
| Scan results | 5 Aug 2026 | mreyes@firstcommunity.bank | 5 Nov 2026 | Quarterly, or on a schema change |
| Maturity scorecard | 5 Aug 2026 | pnandakumar@firstcommunity.bank | 5 Feb 2027 | Semi-annual |
An answer with no review date is an answer the next application cannot rely on, so it asks the question again — which is the cost this record exists to remove. A section past its review date is stale rather than wrong, and the record says which sections those would be.