Security
LoanConsole records servicing activity. It does not initiate ACH transfers, hold client funds, or custody borrower or investor money. Financial records still deserve protection — here is exactly how they're handled.
What LoanConsole does with money
RECORDS
NEVER
01 · ACCESS
Accounts use email and password authentication with optional TOTP two-factor authentication. Organizations can require MFA for their tenant users. Passwords are stored as hashes; authentication and recovery secrets are protected separately, and sessions can be revoked.
02 · ISOLATION
Each workspace is isolated from other organizations at both the application and database layers. Reviewer, Admin, and Owner roles determine what each teammate can view or change.
03 · INTEGRITY
Covered operating-record changes are captured with the actor, timestamp, and before-and-after values. Issued documents and closed periods are preserved; corrections use a void or reissue path that retains the prior artifact.
04 · DATA
Production data is hosted in managed U.S.-based infrastructure and encrypted in transit. Borrower and investor portals are read-only and scoped to the authenticated party.
05 · PORTABILITY
Self-service CSV/XLSX exports and year-end backup records remain available during billing-related read-only access. Account deletion requests are handled subject to legal, security, billing, backup, and audit-retention requirements.
06 · SCOPE
LoanConsole records servicing activity and payments that occurred elsewhere. It does not provide borrower-payment rails, initiate disbursements, connect to customer bank accounts, or custody client funds.
LoanConsole does not currently claim SOC 2 or ISO 27001 certification. The security practices described on this page are the practices in place today — not a substitute for a third-party attestation. We will update this page if that status changes.
Reach the team directly — we answer specifics before you sign up.
