ReachABLE is designed to make financial education and ABLE information accessible to people with disabilities and their families. We are reviewing our technical infrastructure, privacy practices, accessibility features, and data-handling procedures as the platform prepares for broader implementation. Please do not enter Social Security numbers, banking credentials, or medical records into ReachABLE educational tools.
Zero-persistence
Free tier data never leaves the browser.
Live
Security review (in development)
Audit begins Year 1 of DHHS grant.
Planned 2027
HIPAA status
We are reviewing our data-handling practices.
Live
WCAG 2.2 AA
See our Accessibility page for our accessibility commitments.
Live
Zero-persistence architecture
Data we never store cannot be breached, subpoenaed, or resold. That is the single most important security decision we have made.
Every simulator runs in your browser. Eligibility check, benefits simulator, chatbot, rollover calculator, all computed client-side with JavaScript. Nothing you type reaches our servers.
Session-only voice processing. Speech-to-text runs on-device via the Web Speech API. Audio is never uploaded.
State portal handoff via URL parameters. When you press "Open state portal," the state's own site receives your data, not us. Each state ABLE program has its own state-government privacy policy from that point.
No Social Security number collection anywhere. SSN goes directly to your state's portal on their own secure page.
Regulatory posture and certifications
Aligned with U.S. and international standards required by federal, state, and enterprise partners.
Careful handling of your information
ReachABLE is not a HIPAA covered entity and does not offer Business Associate Agreements.
CCPA / CPRA
California consumer rights honored for every user regardless of residence.
Virginia CDPA + Colorado CPA
Universal privacy rights framework meeting all US state privacy laws.
WCAG 2.2 Level AA
Accessibility is a core commitment; see our Accessibility page.
Security review (in development)
Audit engagement planned Year 1 of DHHS cooperative agreement. Vanta or A-LIGN as auditor.
BIPA-safe design
Voice input transcribed on-device. No biometric collection or storage.
Research review as applicable
Federalwide Assurance oversight for all research components.
COPPA compliant
Verifiable parental consent required for direct children under 13.
Technical controls
Standard infrastructure practices, under review as the platform prepares for broader implementation.
Transport encryption. TLS 1.3 for all connections. HTTP requests redirect to HTTPS.
Encryption at rest. AES-256 for any data we do store (aggregate analytics).
Access controls. Production data access limited to a minimum authorized personnel set. Role-based permissions. Audit logs.
No third-party trackers. No Google Analytics, no Facebook Pixel, no ad networks on the free tier. Aggregate analytics only through privacy-preserving Cloudflare or equivalent.
Incident response plan. 72-hour notification to affected users and enterprise partners for any material breach.
For enterprise vendor security reviews.
Financial institutions, employers, and government agencies evaluating ReachABLE for licensing can request the full documentation packet. We turn around most requests within three business days.
(under review)
Accessibility commitments (see Accessibility page)
Privacy · Terms · Accessibility · Trust Developed by JoinReachABLE, an independent initiative founded by Michelle Yin. Educational information only. ReachABLE is not an ABLE account provider, financial institution, or government agency.