Trust & Security
Security you can verify
Broker Marketplace handles nonpublic personal information on behalf of mortgage and real estate professionals. This page documents how we protect it: an independent penetration test you can read yourself, the certified providers behind our stack, and the controls we operate every day.
Independent third-party assessment
External penetration test: zero findings
On August 1, 2026, CodeCrimson completed an authorized external penetration test of the Broker Marketplace web application. The assessment was carried out by an OSCP+ certified senior penetration tester using manual exploitation alongside automated tooling. It returned no findings at any severity level.
0
Critical
0
High
0
Medium
0
Low
0
Informational
Tester credentials, included in the report
OSCP+
OffSec Certified Professional Plus
OSCP
OffSec Certified Professional
CRTP
Certified Red Team Professional
eCPPT
Certified Professional Penetration Tester
What was tested
Authentication and session handling
Access control and privilege escalation
Injection (SQL, NoSQL, OS command)
API authorization bypass
Cross-site scripting and client-side injection
Insecure deserialization
File upload handling
Sensitive data exposure
Security misconfiguration
Components with known vulnerabilities
Transport security configuration
Logging and monitoring coverage
Testing is continuous. A penetration test is a point-in-time result, so we treat it as a checkpoint rather than a finish line. Independent testing is repeated on an ongoing basis and after material changes to the platform, and the controls described below run every day in between.
Download our Penetration Test
CodeCrimson · Report v1.0 · Issued August 1, 2026 · PDF
100%
U.S. data residency across every core data subprocessor
AES-256
Encryption at rest, TLS 1.2+ in transit, everywhere
SAQ A
PCI scope. No card number ever reaches our servers
Zero
Customer records used to train any AI model
Your data belongs to you
Customer data is classified as confidential and handled on a need-to-know basis. It is used solely to deliver the features a customer has subscribed to. Our commitment is explicit and contractual:
We never sell your data
We never share it without your permission
We never mine it for marketing
We never train AI on it
You can export or delete it at any time
All core data is stored in the United States. Customers retain full ownership and may access, correct, export, or delete their data and close their account at any time. On closure, data is deleted within 30 days except where retention is legally required.
How our program is governed
Security is owned at the engineering-leadership level, with documented practices for access management, change control, vendor risk, and incident response. Our program is mapped to recognized frameworks:
NIST Cybersecurity Framework 2.0
The organizing model for our controls across Govern, Identify, Protect, Detect, Respond, and Recover.
FTC Safeguards Rule / GLBA (16 CFR Part 314)
We process consumer financial information on behalf of financial-institution customers, so our controls are built to satisfy the safeguards those customers must flow down to a service provider.
NIST AI Risk Management Framework (AI RMF 1.0)
Governs our AI features, covering model inventory, human review of generated output, data minimization, and subprocessor risk assessment.
PCI DSS SAQ A
Our payment integration tokenizes all card data through a PCI Level 1 provider, keeping cardholder data entirely outside our environment.
Controls we operate
Defense in depth, described at the level a reviewer needs without handing anyone a map of the platform.
Managed identity
Authentication is delivered by a SOC 2 Type II identity provider. Passwords are hashed with Argon2id, sessions use signed HTTP-only cookies, and breached-password detection plus brute-force protection are enforced at the provider.
Multi-factor authentication
MFA is available to every user, including TOTP authenticator apps and hardware security keys, and can be required at the organization level.
Authorization and least privilege
Every request is scoped to an authenticated identity and role. Team members operate under granular, per-tool permissions that resolve to their supervising account's scope, with no implicit access to a sibling's data.
Encryption in transit and at rest
TLS 1.2+ with HTTP Strict Transport Security on all traffic, and AES-256 at rest across our database and storage providers. Sensitive identifiers and integration credentials receive an additional layer of AES-256-GCM encryption inside the application before they are ever stored.
Multi-tenant isolation
Isolation is enforced on every data access by binding each query to the authenticated identity, reinforced by PostgreSQL row-level security policies on client-facing data paths and centralized authorization helpers.
Secure development
Changes move through version control with peer code review before deployment. Security-sensitive changes receive added scrutiny, third-party dependencies are pinned and centrally managed, and data-accepting routes apply schema-based server-side validation.
Integration integrity
Every inbound webhook, covering identity, payments, email, and connected integrations, is cryptographically verified with constant-time signature comparison and rejected on failure.
Edge protection
A web application firewall and DDoS mitigation front the platform at the edge, and sensitive public endpoints carry additional application-level rate limiting.
File and media access
Stored files are non-public and served through time-limited signed URLs behind an authenticated proxy rather than direct bucket links.
Monitoring and detection
Application errors and performance are monitored with personal-data capture disabled by default and server-side scrubbing of sensitive values. Authentication and security-relevant events are logged through our identity and infrastructure providers.
Secrets management
All secrets are injected from the hosting platform's secret store and excluded from source control. Inbound secret comparisons use constant-time evaluation to resist timing attacks.
Browser hardening
Responses carry a strict transport policy, content-type and referrer restrictions, a constrained permissions policy, and framing controls that mitigate clickjacking and content-type attacks.
AI and LLM data governance
Broker Marketplace is an AI-enabled product, so we treat AI data handling as a first-class control rather than an afterthought. These are the governing principles:
1
No training on customer data
Every large-language-model provider that may process client-related input is, by default or by contract, prohibited from using our inputs or outputs to train its models. We do not enroll customer data in any model-improvement program.
2
Data minimization
Only the content necessary to fulfill a requested feature is transmitted, and all inference is performed by U.S.-based providers.
3
Zero data retention
Every AI provider we use runs under zero data retention. Prompts and outputs are not stored by the provider after a request is served, so there is no accumulating history of customer content sitting with a model vendor.
4
Separation of sensitive and creative workloads
Consumer financial information is processed only by the contractually no-train text providers. Media and creative generation services, used for image, video, and voice marketing collateral, receive the professional's own marketing content and never consumer nonpublic personal information.
5
Human oversight
AI-generated reports and content are presented for the professional's review and editing before use. The model assists, it does not decide.
Subprocessor register
These are the providers that support the platform. All process data within the United States and are governed under our vendor-risk process and applicable data-processing agreements. Attestations were verified against each provider's official trust center. Full audit reports are available from those providers under NDA.
Core infrastructure and data storage
| Provider and function | Compliance attestations | Hosting region |
|---|---|---|
| Supabase Primary application database and encrypted object storage. | SOC 2 Type II · ISO/IEC 27001:2022 · HIPAA (BAA available) · AES-256 at rest · TLS in transit | United States |
| Amazon Web Services Underlying cloud for core data services and transactional notification delivery. | SOC 1/2/3 · ISO/IEC 27001 · PCI DSS Level 1 · HIPAA-eligible · AES-256 at rest | United States |
| Railway Managed application hosting and compute. | SOC 2 Type II · SOC 3 · HIPAA (BAA add-on) · encryption at rest | United States |
| Cloudflare Edge network providing CDN, web application firewall, and DDoS protection. | SOC 2 Type II · ISO/IEC 27001:2022 · PCI DSS Level 1 · TLS | Global edge, U.S. localization |
| MongoDB Atlas Managed database backing the design and creative module. | SOC 2 Type II · ISO/IEC 27001:2022 · PCI DSS v4.0 · HIPAA · AES-256 · TLS 1.2+ | United States |
| Pinecone Vector database for the in-product assistant's knowledge base. No consumer personal information. | SOC 2 Type II · ISO/IEC 27001:2022 · HIPAA (BAA) · AES-256 · TLS 1.2+ | United States |
Identity and payments
| Provider and function | Compliance attestations | Hosting region |
|---|---|---|
| Clerk Authentication, session management, and user identity. MFA with TOTP and hardware keys. | SOC 2 Type II · HIPAA (BAA) · Argon2id hashing · breached-password detection | United States |
| Stripe Payment processing. Card data is tokenized and no card numbers reach our servers. | PCI DSS Level 1 Service Provider · SOC 1 and SOC 2 Type II · AES-256 · TLS 1.2+ with mTLS | United States |
Optional email connectors
| Provider and function | Compliance attestations | Hosting region |
|---|---|---|
| Microsoft Graph Optional Outlook email integration via OAuth 2.0, scoped to the consenting user's mailbox. We never receive the user's password. | SOC 1/2 Type II · ISO/IEC 27001 · least-privilege OAuth scopes · user-revocable | United States |
| Google Workspace Optional Gmail integration via OAuth 2.0. Scoped, consented, user-revocable, with no password custody. | SOC 2 Type II · ISO/IEC 27001 / 27017 / 27018 | United States |
Observability and orchestration
| Provider and function | Compliance attestations | Hosting region |
|---|---|---|
| Sentry Application error monitoring. Default personal-data collection disabled, server-side scrubbing enabled. | SOC 2 Type II · ISO/IEC 27001 · HIPAA · AES-256 in transit and at rest | United States |
| Temporal Cloud Durable workflow orchestration for background jobs. | SOC 2 Type II · HIPAA (BAA) · AES-256-GCM at rest · TLS 1.3 | United States |
AI and machine-learning providers
| Provider and function | Attestations | Trains on your data? |
|---|---|---|
| Fireworks AI Open-model inference for report and content generation. | SOC 2 Type II · ISO 27001 / 27701 / 42001 · HIPAA | No, and zero data retention is on by default. No training on API inputs or outputs. |
| OpenAI Text embeddings and selected generation through the API platform, not consumer ChatGPT. | SOC 2 Type II · ISO/IEC 27001:2022 · HIPAA (BAA) | No. Zero Data Retention is enabled on our account, so prompts and outputs are not stored. API data is not used to train OpenAI models. |
| Google Gemini and Vertex AI Text and multimodal generation on the paid API. | SOC 2 Type II · ISO/IEC 27001 / 27017 / 27018 · HIPAA (BAA) | No. On the paid API and Vertex AI, Google does not use prompts or responses to train its models, and we run with retention disabled. |
| xAI Text generation through the enterprise API, not consumer Grok. | SOC 2 Type II (vendor-attested) · BAA on request | No. Contractually barred from training on API inputs and outputs, and configured for zero data retention. |
| Deepgram Speech-to-text for user-recorded marketing media such as captions and transcripts. No consumer financial data. | SOC 2 Type II · HIPAA (BAA) · PCI DSS (self-attested) | No. Model improvement is turned off for our requests and media is processed under zero data retention. |
| Replicate Hosted image and video generation models for marketing creative only, such as graphics and short video. | No public SOC 2 or ISO attestation at this time, so we scope its access accordingly. | No. Run under zero data retention and scoped to non-personal marketing content only. No consumer financial information is transmitted. |
Scope note on creative-media providers. Replicate and Deepgram are used exclusively for marketing creative, meaning graphics, video, and the captioning of a professional's own media. Consumer financial information is never routed to these services. Where a provider's certification coverage is more limited, we constrain the data it can receive accordingly. Additional minor service providers that process only non-personal or publicly available data, such as stock media, mapping, and link shortening, are managed under the same vendor-risk process and are available on request.
Payment security
Subscription billing runs on Stripe, a PCI DSS Level 1 service provider. Card details are entered directly into hosted payment surfaces and tokenized, so no primary account number ever reaches a Broker Marketplace server. We store only non-sensitive billing references and subscription status, which places us in the reduced PCI DSS SAQ A scope.
Resilience and recovery
Core data resides in managed services engineered for high availability across multiple availability zones. Our primary database is backed up daily with point-in-time recovery available for production workloads. Object storage is durably replicated by the underlying cloud provider, and application infrastructure is reproducible from version-controlled configuration, which enables rapid redeployment.
Incident response
We maintain an incident-response practice covering detection, triage, containment, eradication, recovery, and post-incident review. If a confirmed security incident affects customer data, we notify affected customers without undue delay and cooperate with their own regulatory notification obligations, consistent with GLBA Safeguards Rule expectations and applicable state law.
Privacy and regulatory compliance
GLBA and the FTC Safeguards Rule
Our controls are designed to meet the safeguards a financial-institution customer must impose on a service provider that handles nonpublic personal information. We will execute a data-processing and security exhibit on request.
CCPA and CPRA
We honor California consumer rights to know, delete, correct, and opt out. We do not sell personal information.
GDPR posture
For any EU personal data, our processing terms incorporate Article 28 controller-processor terms and Standard Contractual Clauses. All storage is U.S.-based.
Data-subject rights
Customers can access, correct, export, and delete their data directly in-product, with a documented intake path and a 30-day response commitment.
Our full Privacy Policy and Terms of Service set out the complete commitments.
Shared responsibility
Security is a shared responsibility. Broker Marketplace secures the platform, the infrastructure, and the controls described on this page. Customers are responsible for keeping their credentials confidential and enabling MFA, managing their own team members' access and permissions, ensuring they have a lawful basis and any required consent for the consumer data they choose to upload, and configuring optional third-party integrations appropriately. We provide the tooling to make that possible, including access controls, MFA, access auditing, export, and deletion.
Talk to us about security
Running a vendor review?
We welcome security questionnaires and a call with your third-party risk team. Under a mutual NDA we will share our full Information Security and Vendor Risk Overview along with our subprocessors' underlying audit reports.
Reporting a vulnerability?
We welcome coordinated disclosure. Email us and we will acknowledge your report and keep you updated through remediation. Please do not access, modify, or retain data that is not yours while testing, and give us reasonable time to fix an issue before publishing.
This page describes controls in effect as of August 1, 2026. It is provided in good faith for evaluation purposes and is not a contractual warranty or a substitute for the referenced providers' formal audit reports. Statements about subprocessors are based on those providers' published attestations as of that date. Last updated August 1, 2026.
Empowering Mortgage Professionals
The complete platform for mortgage loan officers to find deals, mine databases, and create value for referral partners.
Free Resources
© 2026 Broker Marketplace. All rights reserved.