Security and compliance posture
Review security and data responsibilities before using live borrower information. This checklist is not a certification or a promise of regulatory compliance.
Activity and Audit Review
Confirm which events are recorded, who can view them, and how logs are retained before adopting the platform. This page does not certify audit completeness.
- Review captured events and attribution
- Verify log access and retention
- Confirm export availability for each role
Role-Based Access Control
Evaluate access using synthetic data and each intended role. Confirm record visibility and export permissions rather than assuming every feature is available to every user.
- Test individual and team record visibility
- Review administrative permissions
- Confirm session and account controls
Data Handling and Encryption
Request current technical details about transport encryption, storage encryption, hosting, backups, and access logging. No encryption standard or security certification is claimed here without supporting evidence.
- Confirm encryption configuration and coverage
- Review hosting and backup responsibilities
- Do not submit live borrower data during evaluation
Compliance Workflows
Technology can support a workflow, but it does not establish legal compliance. Your organization remains responsible for lender requirements, disclosures, consent, recordkeeping, and applicable law.
- Review the workflow with your compliance team
- Confirm disclosure and consent responsibilities
- Verify lender and LOS requirements
Data Retention and Deletion
Confirm retention, export, deletion, and backup behavior before uploading sensitive information. Refer to the privacy policy and applicable agreement for stated terms.
- Confirm retention and deletion procedures
- Review export and offboarding requirements
- Clarify backup retention and recovery
Integration Credential Handling
Provider-specific connections require a separate review of authorization, account ownership, permitted operations, and credential handling. No universal provider compatibility is claimed.
- Confirm supported providers and operations
- Review credential storage and rotation
- Use least-privilege provider permissions
Change History
Ask which configuration and permission changes are recorded and how administrators can review them. Verify the current implementation during evaluation.
- Review configuration-change visibility
- Confirm permission-change records
- Clarify administrator responsibilities
Questions about security?
If you have specific questions about our security practices, data handling, or compliance capabilities, we are happy to discuss them.
Security and Privacy Inquiry