Oportun Increases the Accuracy of Sensitive-Data Discovery by 95% Using Amazon Macie

Oportun is a mission-driven organization that provides responsible and affordable financial services, at scale, to millions of people in the United States who are often poorly served by traditional financial services companies. At the core of its advanced credit decisioning engine is Oportun’s ability to process and interpret large volumes of consumer data, including PII, from disparate sources. The security and integrity of that data are absolutely essential. Oportun’s data security organization spends a great deal of time and money working cross-functionally with other teams to raise awareness around PII data security and remediate issues when they find them. Still, the team is always on the lookout for better tools to help reduce Oportun’s risk. That’s how Oportun discovered Amazon Macie in late 2021.

To accomplish its security goals—in addition to satisfying regulatory mandates and member demands for privacy—Oportun needed a solution that would not burden its security team with false positives as it scanned data. Other solutions Oportun tried required significant technology investments and still failed to achieve accuracy goals. “Accuracy is key,” says Carlos. “And we’ve found that Amazon Macie is 95 percent accurate for the critical attributes that we scan for, including social security numbers and tax identification numbers.”

It’s vital that Oportun’s technical teams can articulate the financial impact of risk issues to a nontechnical audience. To that end, the company uses a combination of AWS services to identify, assess, and communicate risk across the enterprise. Oportun uses Amazon Macie to identify sensitive data, and then uses Amazon Athena, an interactive query service that makes it simple to analyze data in Amazon S3 using standard SQL, to evaluate it. “We scan Amazon S3 buckets with Amazon Macie, send the results back to Amazon S3, and use Amazon Athena to read that result,” says Cruz. “Then, we use internal tools to identify unique records across many files to calculate data risk.”

Within its new solution, Oportun makes heavy use of Amazon Macie–automated data discovery to identify Amazon S3 buckets with potential PII in a cost-effective and scalable way. With automated data discovery, Oportun doesn’t have to scan every single Amazon S3 bucket completely. Instead, it can identify and prioritize which Amazon S3 buckets must be remediated to accelerate risk reduction. The data security organization works with a heat map of priority buckets to remediate. Based on the heat map, the data security team engages other teams in agile sprints to rapidly remediate potentially risky data. Increased visibility into exposure has made it easier to align the organization around data security. The team also uses Amazon QuickSight, a service that powers data-driven organizations with unified business intelligence at hyperscale, to make it simple for everyone in the organization to understand the data.

A primary goal was to reduce risk as much as possible so that member PII is safer in the event of inadvertent access. Oportun is proud of the work that it has done to achieve that goal. “Using Amazon Macie, I think we’re pushing the envelope for the fintech space,” says Carlos. “We have a better sense of where our data is across a number of sources.”

Oportun is continually developing innovative data protection solutions as it seeks to remain ahead of both threats and competitors. Next, the company will use AWS capabilities to complement its current pipeline and add features, like observability and alerting, to improve risk monitoring and response. In addition to developing new tools, the team will be driving optimization to reduce its total cost of ownership. Due to the rapidly changing nature of member data, Oportun’s data security efforts have far-reaching effects. “When we started using Amazon Macie, scanning time went from days or weeks to hours, even hitting 30 minutes for smaller Amazon S3 buckets under 1 TB,” says Carlos. “And we saw that these findings were valid.”

The company is comfortable leading the way with new ideas. “We’re happy to collaborate with the AWS team on proof-of-concept work for new technologies,” says Carlos. “We want to do more, and using Amazon Macie is making that simpler.”