Last updated October 2026. Draft pending attorney review.
Encryption
Every uploaded document is encrypted with its own AES-256-GCM key, and those keys are themselves encrypted with a master key held outside the database. Connections use TLS end to end through Cloudflare.
Sign-in
Passwords are stored with the scrypt algorithm. Every sign-in requires a second factor: an authenticator app for our staff and a one-time email code for clients. Sessions expire after inactivity.
Need-to-know access
Borrowers see their own loans. Brokers see only the loans they submitted, without personal financial documents. Every document view and download is recorded in an audit log.
AI assistant
Our loan helper answers from your own file only. Social Security and account numbers are removed before any text is processed, and tax returns, IDs and bank statements are never sent to the assistant for clients or brokers.
Report a concern
Write to [email protected]. Never send funds based on emailed wire instructions; always confirm by phone with our office.