Security and data

Every request passes through checkpoints

Loan applications contain personal data, so security is built into every step — on the way to the lenders and on the way back to you.

Your platform On the way to lenders Lenders

Personal API key

You generate the key in the client portal. The server stores it only as a hash, and the full key is shown once.
Rate limiting

Every client has its own request limit, protecting the system from overload and abuse.
Client isolation

Each client sees and sends only its own applications, and only to the lenders enabled for it.
Encrypted data

Application data and lender credentials are stored encrypted. Credentials are kept separately per client and per environment.

Your platform On the way back to you Lenders

Verified responses

Lender callbacks are authenticated wherever the lender supports it, and each one is stored in its raw form.
Duplicate filter

Identical callbacks received again are not processed twice and never trigger extra notifications.
Verifiable webhooks

Every notification carries a stable event_id and your verification token, so you can confirm where it came from.
Audit trail

Every application sent, response received and notification delivered is recorded and traceable.

The client portal supports two-factor authentication and passkeys.

Your data, under your control

You decide who receives what. An application is sent only to the lenders you name in the request and that are enabled for you. A lender that is not enabled never receives it, and that decision is recorded in the history.
A separate test environment. You build and verify the integration in a test environment with separate credentials before the first real application is sent.
Every step can be proven. The audit trail shows what was sent and when, which lender responded and when the notification was delivered to you.

If your security or compliance team needs more information about data processing, write to us and we will prepare it to match your requirements.

Tell us which lenders or platforms you work with, and we will show you how to connect them through a single API.