Security at Mortgage Clarity
Mortgage Clarity processes borrower financial data for advisors at GLBA-regulated lenders. This page covers how we handle that data, the agreements behind it, how we govern AI, and where our compliance program stands today.
How we handle your data
Encryption
TLS 1.2 and 1.3 only, on every connection, with forward secrecy. Qualys SSL Labs graded every production endpoint A+ in August 2026, and the assessment is repeated annually and on any hosting change. Data at rest is encrypted on the database and file storage.
Tenant isolation
Advisor identity is derived server-side from a verified session token, never from anything the browser sends. Row-level security is enabled on every table as defense in depth behind the application layer, and authorization is enforced at the API, not the interface.
Account protection
Sessions live in httpOnly, Secure, SameSite cookies, never browser storage. Passwords are screened against known breach corpora at signup and reset, and authentication endpoints are rate limited. Advisors can turn on two-step sign-in, a code sent by email after the password; requiring it for everyone is on our roadmap, and SSO (SAML/OIDC) ships with the first enterprise rollout.
Access logging
A borrower access trail records which advisor viewed which record and when, the log a GLBA examination asks for. Request logs strip sign-in and share-link tokens. Some application log lines can still carry a contact detail, such as an email or a property address, and removing them is on our remediation list. Product analytics runs on advisor pages and the public website, never in client workspaces or shared reports. It records which features are used and which pages are visited rather than borrower details, and its screen recordings, on advisor pages only, mask all text and form entries.
Backups & recovery
Encrypted database backups run daily. The database restore path was tested in August 2026 against a production backup, restored into an isolated project, with data, indexes, foreign keys and authentication state verified: measured recovery time under 15 minutes, recovery point up to 24 hours. The test repeats at least annually. These backups cover the database only. Uploaded files, including borrower documents, are not yet covered by a separate backup, and closing that gap is on our roadmap.
Retention & deletion
Automated daily jobs delete uploaded fee sheets and condominium documents after 90 days, expired videos, and accounts scheduled for deletion once their grace period ends. Not every data category has an automated period yet, and completing that schedule is on our roadmap. Advisors can export their account's core records themselves. Cancelling a subscription pauses the account and deletes nothing; deleting an account runs a 30-day cancellable grace period, then a full purge. Borrower records are never aged out unilaterally, because the advisor carries their own retention obligations.
Agreements
The contractual layer behind the controls: what we sign, what we publish, and what we answer.
Data processing agreement
Drafted with GLBA Safeguards Rule flow-down, breach notification terms, and subprocessor obligations. It is in legal review and will be offered for countersignature when counsel signs off, because a DPA is a contract, not a policy.
Terms & privacy
Published terms of service and privacy policy cover data use, RESPA boundaries, and the advisor-client relationship. Advisors export their core records and schedule account deletion themselves. A borrower's record belongs to their advisor, so a borrower's access, correction, or deletion request goes to the advisor, and we act on the advisor's instruction.
Subprocessor notice
The complete subprocessor list is published below and maintained as a controlled document. When a provider is added, the list and the privacy policy are updated and advisors are asked to accept the new policy. Advance notice before a new provider begins processing is on our roadmap.
Vendor questionnaires
Send a SIG Lite, CAIQ, or your own form and we return it completed, together with the supporting documents from the diligence packet.
Data & AI governance
This platform uses AI to help produce financial analysis, so the boundary around it is engineered, not aspirational. Clarity Pilot and every AI-assisted feature run on Claude models from Anthropic, listed below as a subprocessor with exactly what it receives. Mortgage Clarity is a member of the Anthropic Startup Program; that is a startup program, not a certification or a security attestation.
No training on customer data
Our AI provider does not train on data submitted through its API. Borrower data never becomes training data.
The advisor controls what reaches a client
AI-drafted strategies, call recaps, and game plans stay drafts until the licensed advisor publishes or approves them. Three features reach a client without line-by-line review, and only when the advisor switches them on: the client Pilot, an AI assistant that answers a client's questions live inside their workspace; call summaries from a call recorder the advisor connects; and figures read from a closing disclosure the advisor uploads for the client.
Deterministic math, not generated math
Payments, amortization, breakeven, and closing costs come from a tested calculation engine, never from the model. The model can supply inputs by reading a document, such as a fee sheet or a mortgage statement; the arithmetic on them is always the engine's.
A documented AI boundary
The data inventory records exactly which fields reach a model and which never do, and borrower NPI is classified Restricted under our data classification standard. Every tool an AI assistant can use is checked against the user's seat and plan at the moment it runs, so text inside a document or transcript cannot unlock a tool the user was not offered. Further isolation of untrusted document and transcript text is on our roadmap.
Policies
Adopted August 2026. Any of these is available on request.
- Information security (WISP)
- Incident response & breach notification
- Access control
- Data classification
- Data retention & deletion
- Data inventory & flow map
- Subprocessor management
- Vulnerability management
- Logging & monitoring
- Encryption & key management
- Secure development (SDLC)
- Acceptable use
- Security training
- Individual rights
Compliance
Our own team reviewed the full application surface in July and again in September 2026. These are internal reviews, not an independent audit. Every finding is tracked with an owner, a fix, a verification, and a management sign-off, and live vulnerabilities are fixed before anything else. We are preparing for a SOC 2 Type II examination scoped to the Security and Confidentiality criteria, going straight to Type II rather than a Type I, and we hold no SOC 2 report today. A third-party penetration test is scoped, including the share-link and client-portal token surfaces. Card data is fully outsourced to Stripe, which keeps us in PCI SAQ-A scope.
In preparation, scoped to the Security and Confidentiality criteria. We are going straight to Type II rather than a Type I. No report is held today.
Controls aligned; access audit trail in production.
Card data is fully outsourced to Stripe.
Mapping produced from SOC 2 evidence.
Pursued only if a specific enterprise agreement requires it.
Available today
Sent on request, usually same day.
- Security overview and control summary
- Information security policy (WISP)
- Incident response and breach notification procedure
- Access control, encryption, and logging standards
- Data classification, retention, and deletion policies
- Data inventory and data-flow map, including the AI boundary
- Vulnerability management and secure SDLC procedures
- Subprocessor list
- Privacy policy and terms of service
- Architecture and data-flow description
- Internal security review summary (July and September 2026, performed by our own team)
- Certificate of good standing
- W-9 and organizational structure
Follows the audit
Not yet issued. Listed so you can plan around it.
- Completed SIG Lite / CAIQ questionnaire
- Data processing agreement (DPA)
- Penetration test attestation letter
- SOC 2 report, once issued
- Certificate of insurance
- Business continuity and DR test results
Subprocessors
Every vendor that touches customer data in production, what it does, and where it processes. When a provider is added, this list and the privacy policy are updated, and advisors are asked to accept the new policy.
Database, authentication, and file storage
Advisor and borrower records, documents
Application hosting
Request processing; no independent data store
Edge network, TLS termination, and DDoS protection
All traffic in transit. Reached through our hosting provider rather than a direct contract, and listed anyway because it terminates TLS.
AI analysis drafting and summarization
Borrower scenario details, the text and pages of uploaded documents, call transcripts for recaps, and client Pilot conversations. Not used for model training.
Subscription billing
Advisor billing details. Card data never reaches our servers.
Transactional email delivery
Recipient name and email address, message content
Sign-in and web fonts
Advisor identity
Optional call recording and transcription
Call transcripts, only when an advisor enables it
Brokers the accounts an advisor chooses to connect
The credentials for each connected account, and the data passing between it and Clarity: calendar events, call transcripts, files, spreadsheet rows, and messages. Only for accounts an advisor connects.
Property valuation and public record data
Property address. Returns estimated value, comparable sales, and recorded liens.
Our own customer relationship records and demo scheduling
Advisor contact and account details, and the name, email, and time of a booked demo. No borrower data.
Product analytics
Product usage events from advisor pages, and page visits and sign-up clicks from the public website. Never client workspaces or shared reports. Screen recordings run on advisor pages only and mask all text and form entries. No borrower financial data.
Property data lookup
Property address only
Title and closing cost quotes
Property address and transaction parameters
Map rendering
Coordinates and addresses
Geographic data
Coordinates and addresses
Accounts advisors connect
Not subprocessors: each acts under the advisor's own agreement with it, and nothing is connected unless the advisor chooses it. Composio, above, brokers the connection.
Report a vulnerability
If you believe you have found a security issue, email us directly. We will acknowledge within one business day, and we will not pursue anyone who reports in good faith.
security@mortgageclarityplatform.comRelated
Last reviewed September 2026. This page is maintained against our internal security reviews and policy library.
Bring us your questionnaire.
We would rather answer the hard diligence questions early than discover them in month four of a rollout. Send the form you already use, or tell us what your review needs and we will assemble it.