What your CCO and your IT lead will ask first

Loandock reads and writes your system of record and handles borrower NPI. No lender should schedule a walkthrough before the answers below are in writing, so they live on a page instead of in a sales call.

Where the data actually sits

• Your LOS stays the system of record. Documents land in your instance and the condition status is set there, so the authoritative copy of every borrower file is yours, in your instance.
• United States only. The workflow runs in US regions, and no borrower NPI is handled by anyone outside the United States. There is no offshore labor in any part of processing.
• TLS 1.2 or higher in transit, AES-256 at rest, for every borrower document and message.
• Multi-factor authentication on every system that touches borrower data, including LOS access, cloud infrastructure, email and source control. Your LOS credentials sit in an encrypted secrets manager, never in plaintext, never in code, never in a spreadsheet.
• Access is least-privilege, tied to a named individual, no shared logins. It is reviewed quarterly and on any personnel change, and revoked the same day on separation.
• Live borrower data is never used in development or testing.
• Borrower documents and borrower conversations are never sold and never shared with another lender.
• Every read, every write, every message, and every check against a condition is logged with a timestamp and the document behind it. That log exports in full for your QC and audit files.

How AI touches borrower data

This is the first question a CCO asks, so it gets a straight answer. Model processing runs in United States regions, through commercial APIs under enterprise terms that contractually prohibit using submitted data to train the provider's models. Never a consumer AI product. No borrower document and no borrower conversation is used to train, fine-tune, or improve any model, ours or anyone else's. Only the data a given step actually needs is passed to a model; whole loan files are never bulk-uploaded. Anything the system cannot complete confidently is escalated to a person rather than guessed at.

The rules we are built against

• The GLBA Safeguards Rule, 16 CFR Part 314, and the FTC Safeguards Rule as amended, including a designated qualified individual, a written risk assessment, and a written incident response plan.
• State privacy statutes in the states our clients originate in, including the Florida Information Protection Act.
• TCPA and applicable state quiet-hours rules on every borrower message.
• A written risk assessment, performed at least annually and after any material change to systems or subprocessors, with findings tracked to closure.

If something goes wrong, and when data goes away

• We notify an affected client without unreasonable delay and no later than 72 hours after confirming an incident involving that client’s data, with the facts known at that time.
• You are the data owner. You control borrower notification unless the law directs otherwise, and we cooperate fully with your investigation and any regulatory notice you have to make.
• On termination we return or securely destroy client and borrower data within 30 days of written request, and certify the destruction in writing if you ask.
• Disposal is cryptographic erasure or secure deletion.
• Everyone with access to borrower data is background-checked and under a confidentiality agreement, with security awareness training at onboarding and annually.

Borrower contact

Clara, the borrower-facing agent, identifies itself as Loandock's automated assistant on first contact, names your company, and hands off to a person the moment a borrower asks for one. Sends are TCPA and quiet-hours gated and opt-outs are honored automatically. Read the SMS policy and the privacy policy for the full terms.

What we do not do

Loandock is a technology platform, not a lender. It does not make credit decisions, does not price loans, does not touch your AUS findings or business rules, and does not clear conditions. Loandock marks conditions fulfilled; your underwriter clears them. NMLS 2662424.

The due-diligence packet

Ask and the packet goes to your CCO and your IT lead the same day, ahead of any demo. It covers GLBA safeguards and NPI handling, data residency, the retention window and deletion process, the subprocessor list, incident and breach notification commitments, access controls and role permissions, penetration testing, and business continuity. If your vendor-management policy has a form, send it and we will fill it out rather than hand you a brochure.

On SOC 2, the honest answer: we do not have a report yet. What we do have is a written information security policy, already submitted to an institutional client under diligence, and it goes to your IT lead on request along with everything above.

Email info@loandock.com with the subject line “due diligence” and name the artifacts you need. If an answer is “not yet,” you will get “not yet” and a date, not a hedge.

The integration itself

The exact objects Loandock reads and writes inside Encompass, and what it never touches, are spelled out on the Encompass page. Your LOS admin should read that one.

Loandock is a technology platform providing tools and services to mortgage professionals. Loandock is not a lender and does not make credit decisions. Equal Housing Opportunity.