To facilitate mandatory enrollment in the My65+ retirement plan for SEIU members, the WorkersFirst mobile app required a secure method to collect sensitive personal data, such as Social Insurance Numbers (SIN). Because legal constraints prevented the primary application from directly handling or storing this specific information, the solution involved a technical integration that bypassed the WorkersFirst infrastructure entirely. This ensured that sensitive data remained within the compliance boundaries of the retirement plan's specialized systems. The integration was architected using an embedded iframe within the WorkersFirst app, which loaded a dedicated My65+ data collection page. To manage the communication between these two distinct environments, a robust protocol was developed using the postMessage API. This allowed the parent application and the iframe to perform a secure handshake, ensuring a verified connection before any data exchange occurred. During this process, WorkersFirst provided a unique token to the My65+ interface, which was then validated against the backend to confirm the user's identity and session integrity. Once the secure link was established, the user entered their sensitive information directly into the My65+ interface. This data was transmitted straight to the My65+ backend, ensuring that WorkersFirst never "touched" or cached the sensitive records. This architecture maintained a high level of security and data privacy while providing the user with a cohesive onboarding experience. After the successful exchange and data capture, the information was securely stored within the My65+ system. This triggered an asynchronous enrollment process, where a batch worker picked up the verified records to complete the registration. This design successfully automated a complex regulatory requirement, allowing members to become eligible for work shifts without manual administrative intervention.