Security
Confidential material stays confidential.
What we hold, how it moves, and who sees it. Laid out the way your examiner will ask for it.
It is not data. It is someone’s business, on paper.
Tax returns. Bank statements. The owner’s personal guarantee. Held the way you would hold them.
Access
Role-based permissions down to the individual field.
Provenance
Every value carries its source and page; every change its author and hour.
Encryption
In transit and at rest. Borrower material never trains a model.
Assurance
SOC 2 in progress. Stated, not badged.
Follow one document through.
From the hour it arrives to the moment it leaves: every step named, every export logged. The trail that answers an audit is the trail that governs us.
Never a shared inbox.
Material arrives
Filed against its loan, stamped with sender and hour. Never a shared inbox.
Agents read it
Inside your tenancy. Borrower material never trains a model.
People open it
Scoped to role, down to the field. Access is itself on the trail.
It leaves
Only as an export a named person requested, and the export is logged.
Provenance written as the work happens. Nothing reconstructed after the fact.
Where we stand, and what is not done yet.
You should hear it from us, not find it.
A claim with a stated status is worth more to a reviewer than a wall of badges. This list is kept current. The evidence behind any row is available to your review now. You do not have to wait for a certificate to see it.
Encryption in transit and at rest
In place
Role-based access, field-level scoping
In place
Who opened what, and when · access itself on the trail
Built in
Logged exports, named requesters
Built in
No training on borrower material
Contractual
SOC 2 Type II
In progress
Examination access for your regulator
Welcomed
Residency and deployment, fitted to your examiner’s requirements
By arrangement
Sub-processor list and data-processing terms available on request.
Your diligence, pre-assembled.
Vetting a vendor is underwriting. You still have to do it yourself, so we did the assembling.
Where does borrower material live?
Inside your tenancy, encrypted in transit and at rest. Residency and deployment by arrangement.
Who can open it?
Role-scoped people, down to the field. Every open is itself on the trail.
Does it train models?
No. Not ours, not anyone else’s, and that is contractual.
Who else touches it?
The sub-processor list is short, named, and kept current. It ships with the package.
What happens if we part ways?
Your file leaves with you: full export first, then deletion. Terms are in the data-processing agreement.
How do we hear about an incident?
From us, directly and fast. Notification terms are written into the agreement, not a policy page.
Where are the certificates?
SOC 2 Type II is in progress. Stated, not badged. The evidence package stands in until it lands.
The full package is organized the way your process asks: by your regulator’s checklist, not by our feature list.
Reviewing us? Send the questionnaire.
We answer it directly, and we will name what is not done yet.