Authenticated access and record visibility
Employee access uses authenticated sessions. Role and contact-visibility controls support access decisions within the workspace.
A review should establish the organization’s roles, who may see which records, how accounts are provisioned and removed, and how the deployed system enforces those decisions. Requirements for identity providers or additional authentication controls must be confirmed for the proposed deployment.
Protected document evidence
The document-processing architecture includes record-bound AES-256-GCM encryption for extracted evidence, with key material held separately from the database.
This description is specific to extracted document evidence. Your review should map the complete data flow, including source documents, other CRM fields, storage locations, access paths and key management, to establish coverage for your requirements.
Purpose-scoped AI processing
The sensitive-data broker applies identifier redaction on supported external-model paths and records metadata about processing purpose and provider. Model output and document findings remain subject to human review.
Review the providers, allowed purposes, data sent on each path, retention requirements and subprocessors for your intended configuration. Controls described for one processing path should not be assumed to apply to every integration.
Review and traceability
Sensitive-data processing has dedicated audit records. Findings from document analysis should remain tied to source evidence so that a professional can review the basis for a result.
Discuss the event coverage, access to audit information, retention periods and evidence needed by your organization. Final underwriting, disclosures, closing and funding remain within your approved origination systems and processes.
Bring your vendor questionnaire
A useful review should cover your requirements before an implementation commitment. Topics include:
- Architecture, hosting and data flows.
- Authentication, role configuration and record access.
- Encryption coverage and key management.
- AI providers, subprocessors and human oversight.
- Retention, deletion, incident response and recovery requirements.
- Integration boundaries and supporting operational evidence.
Use the pricing inquiry’s IT / security review option to start the discussion. The public form is for business information only; do not send borrower names, SSNs, account numbers or loan documents.
Establish the controls for your deployment
These descriptions summarize product architecture. Coverage, configuration and supporting evidence must be validated during review.
This page does not represent SOC 2 or ISO 27001 certification, regulatory approval, a guarantee of bank acceptance, or a commitment to a specific recovery or incident-response standard. Contractual and operational requirements must be established for the proposed deployment.