Security Centre

Encryption Standards

CIBC Digital Business encrypts all data transmitted between your browser or mobile device and our servers using 256-bit TLS (Transport Layer Security). This is the same encryption standard deployed by major financial institutions globally and military-grade security frameworks. Every login session, balance inquiry, payment instruction, and account statement request travels through an encrypted tunnel that renders intercepted data unreadable to third parties. Server-side, account databases employ AES-256 encryption at rest, meaning stored account information and transaction records remain protected even in the unlikely event of physical infrastructure compromise.

The encryption handshake occurs before any sensitive information leaves your device. Your browser verifies the digital certificate presented by the CIBC Digital Business server, confirming the authenticity of the endpoint. Certificate pinning in the mobile app adds an additional verification layer that prevents man-in-the-middle attacks using fraudulent certificates. Session keys rotate at regular intervals during active banking sessions, limiting the exposure window of any single key.

Multi-Factor Authentication

Multi-factor authentication (MFA) stands between unauthorized access attempts and your business accounts. After entering your digital banking ID and password, the system requires a second verification factor: a one-time code sent via SMS to your registered mobile number, a push notification to the CIBC banking app on your enrolled device, or — for commercial banking clients with higher security requirements — a code generated by a hardware security token. This layered approach ensures that a stolen or guessed password, by itself, cannot grant entry to your accounts.

Administrators managing multi-user business profiles can enforce MFA policy across all authorized users, set session timeout intervals, restrict access to specific IP address ranges, and review authentication logs showing every login attempt — successful and failed — with timestamps, IP addresses, and device fingerprints. Dual-approval workflows add yet another barrier: one team member initiates a wire or ACH batch, and a second authorized user must approve the release before funds move. No single compromised credential can initiate and complete a significant funds transfer.

Fraud Monitoring and Anomaly Detection

CIBC Digital Business runs real-time fraud detection algorithms against every transaction passing through the platform. The system builds behavioural profiles for each business account — typical transaction sizes, common beneficiary accounts, regular payment schedules — and flags deviations from the established pattern. A wire transfer to a new international beneficiary that arrives outside normal business hours and exceeds the account's historical maximum by a factor of five, for example, would trigger an automated review. The transaction may be held pending verification while the system sends an alert to the account administrator's registered contact channels.

For commercial banking clients, additional monitoring layers include velocity checks that detect rapid sequences of payments to new recipients, geolocation analysis that compares login locations against travel patterns, and beneficiary screening against international sanctions and watchlists. The fraud operations team operates with coverage that spans all Canadian business hours plus extended monitoring for after-hours international payment corridors.

Security Feature Comparison

CIBC Digital Business deploys security controls across five protection layers — the table below maps each feature to its function and availability.

Device Recognition and Access Control

Every time you log into CIBC Digital Business, the platform builds a device fingerprint from browser characteristics, operating system details, screen resolution, installed fonts, and other attributes that collectively identify your specific device. This fingerprint is compared against previously registered devices on your account. A login from a new device — even with correct credentials and MFA — triggers additional identity verification steps such as answering a pre-set security question or confirming through a second registered contact channel. Business account administrators can review the list of registered devices and revoke access for any device they no longer recognize.

For commercial clients operating from fixed office locations, IP whitelisting adds a perimeter control: the platform will only accept authentication attempts from IP addresses within the approved range. Attempts from outside that range are blocked before reaching the password prompt. Combined with device recognition, this creates two parallel gatekeeping mechanisms that operate independently: where you are connecting from, and what device you are using.

Audit Logging and Compliance

CIBC Digital Business maintains immutable audit logs of every significant event within the platform: login attempts (successful and failed), transaction initiations and approvals, user permission changes, beneficiary additions, data exports, and session terminations. Each log entry carries a timestamp, user identifier, IP address, device fingerprint, and action description. These logs serve dual purposes — they are the primary data source for internal security investigations when anomalies are detected, and they provide the evidentiary trail required by external auditors, regulatory examiners, and your own internal compliance reviews.

Logs are retained in accordance with Canadian financial record-keeping requirements as specified by OSFI guidelines. Business account administrators can request export of their organization's audit logs through the support resources page, subject to identity verification and approval from a second authorized user. For additional information about Canadian data protection standards, visit the Office of the Privacy Commissioner of Canada.

After a thorough security review of the CIBC Digital Business platform, our audit committee was satisfied with the combination of MFA enforcement, dual-approval payment workflows, and the immutable audit trail. Those three controls together address every concern our external auditors raised last cycle.

— Laura Espinoza-Muñoz, Controller, Summit Industrial Supply, Edmonton

Visit the Financial Consumer Agency of Canada for additional information about consumer protection standards in Canadian banking.

Related Services