What we do with your data. And what we never do

Connection pending

Today you share your finances by uploading recent bank statements. We read them to compute your cashflow, and we never ask for or see your bank login.

A direct bank connection through Plaid is built and waiting on the provider connection. Plaid is the regulated infrastructure provider trusted by Venmo, Robinhood, and every major US neo-bank. When it is on you will authenticate directly with Plaid, we still never see your login, and Plaid hands us read-only transaction data. Plaid cannot initiate any transfer on your behalf.

Once it is live, you will be able to revoke Plaid access in your bank's dashboard or Plaid's consumer portal and our access will stop immediately.

Connection pending

No bureau contract is connected yet. Until one is, production pulls fail closed: a live inquiry is refused rather than served from sample data. Sample bureau clients exist only for labeled demos and never feed a production inquiry.

• TLS 1.3 in transit on every connection to our servers.
• Sensitive fields are encrypted with XSalsa20-Poly1305 (libsodium secretbox).
• At rest, our managed Postgres volume is encrypted with AES-256.
• Secrets are stored as Vercel environment variables, never checked into git.
• Uploaded merchant statements and documents, identity photos, partner and deal paperwork, lender contract paper and brand images, vendor logos and careers resumes are type-checked and screened for active content (scripts, macros, embedded files and hidden second files). They are not antivirus-scanned. A statement or document a merchant uploads clears only if it passes that screen, and is added to the file lenders review only once it has cleared. A file that cleared before a check began on its kind of upload does not have to pass that check, so a merchant's statement or document that cleared then can still reach the file lenders review.
• Our production database runs on managed Postgres with app-layer tenant isolation, authenticated server access, and audited permission checks before sensitive records are read.

When you request account deletion, we strip your personal and contact fields, disconnect any linked bank account, and disable login in a single operation. The deletion is immediate and cannot be reversed, so we verify the request before we run it.

Routed-deal records, lender evidence, commission and audit rows, and the anonymized application file a regulation requires us to keep (Reg B, 12 months from notice of action) are retained with identity removed, not destroyed, so funders and examiners can still read the economic record. Sanctions screening records, meaning the names we screened against the U.S. Treasury OFAC sanctions lists, the result, and who reviewed any possible match, are kept for 10 years, the period federal sanctions recordkeeping rules set, and then purged. They keep the names that were screened, because the name is the record. Backup and derived copies of erased PII roll off within 30 days of account closure.

Executed agreements, consent records, adverse-action notices, and audit rows that prove what both parties agreed to are kept against an anonymized account pointer. Your name, contact details, tax identifiers, and document files are stripped the day you ask; what remains is the product, the amounts, and the decision.

For cross-merchant underwriting analytics we hold de-identified vectors only: an industry class, a revenue band, a calendar month, and ratio and score metrics. The de-identification is automatic and enforced in code, not done by hand on request. The business behind a vector is a salted one-way hash. Dollar figures, dates, account numbers and transaction text never leave your file, and every row is shape-checked before it is stored, so anything resembling an email address, an EIN, a phone number, an account number or a street address is rejected rather than saved. A cross-merchant figure is published only when at least 20 distinct businesses stand behind it; under that, the answer is that there is not enough data to say.

If we confirm a breach affecting borrower or lender accounts, every affected account holder is notified at the email on file, and notification starts as soon as we know who is affected and what was reached. The deadlines we hold ourselves to are the legal ones rather than a number we picked: the FTC Safeguards Rule requires a qualifying event to be reported to the FTC no later than 30 days after we discover it, and each affected user’s home state sets its own notification deadline, several of them shorter.

A public incident report is published in our incident register on the date of remediation, covering scope, root cause, mitigation, and remaining risk.