Security overview

Borrower names are encrypted with AES-256-GCM before they are written. The key stays in the server environment.

Account numbers are reduced to the last four digits. The full number is not a column.

Statement PDFs are encrypted, then stored in a private bucket (or a private local directory). The browser receives a signed link that expires in five minutes.

Row Level Security isolates every table by brokerage. A user in one org cannot read another org's loans, documents, or audit log.

Views of a statement and uploads are written to an append-only audit log. Logs are scrubbed of account numbers and ciphertext.

Each loan file carries a purge date, 30 days by default. The purge job and the Purge source PDFs button delete the ciphertext and the statement rows. Deleting the loan file removes the rest.