Skip to content

Controls for mortgage NPI

ExactClose minimizes structured PII, encrypts source evidence, isolates tenants, and preserves an explainable access and decision record.

Run five reviews free See exact pricing

What this page helps you do

Minimize exposure

Keep full identifiers inside encrypted source evidence and retain only permitted structured fields.

Isolate every tenant

Bind sessions, API keys, queries, downloads, and activity history to the owning organization.

Preserve accountability

Record privileged actions, report snapshots, source hashes, and material reviewer decisions.

Encryption and minimization

  • AES-256-GCM with random 96-bit nonces for sensitive fields and files.
  • Context-bound authenticated data prevents ciphertext from being moved between field and file contexts.
  • Production startup fails without a 32-byte DATA_ENCRYPTION_KEY.
  • Structured extraction retains SSN/TIN last-four only; full identifiers remain inside encrypted source evidence.
  • SHA-256 integrity hashes identify source documents and report snapshots.

Identity and tenant isolation

  • Memory-hard scrypt password hashing with per-user salts.
  • Session and API tokens are random and stored only as SHA-256 hashes.
  • Secure, HTTP-only, SameSite=Lax cookies and session revocation.
  • Roles: owner, admin, reviewer, and member.
  • Every stateful query includes organization ownership; downloads never accept storage paths from the client.

Application defenses

  • Database-backed login throttling and signup quotas.
  • Magic-byte verification, bounded body and file sizes, XML DTD and entity rejection, and strict extraction allowlists.
  • Documents are evidence and never instructions to the extraction model.
  • Security headers, denied framing, MIME-sniffing protection, restrictive permissions policy, and production HSTS.
  • Signed, replay-deduplicated Stripe webhooks.

Operations launch gates

The deployment checklist requires TLS, loopback-only origin binding behind a reverse proxy, non-root containers, dropped Linux capabilities, no-new-privileges, encrypted off-box backups, restore testing, external health monitoring, alert routing, secret rotation, and a log-retention policy.

Trust roadmap

Before enterprise or regulated production use: complete independent penetration testing, SOC 2 Type I then Type II, vendor and subprocessor register, incident-response exercise, BCP and DR exercise, DPA and GLBA-aligned security exhibits, cyber insurance, and customer-specific retention and deletion configuration.

Report security issues privately to security@vcorp.co. Do not include borrower data in the initial message.

Security boundary

Keep decisions human and evidence explicit.

This page describes product architecture and launch requirements. Certifications are claimed only when explicitly stated.

Continue your evaluation
Browse the library
ExactClose resource

Privacy policy

Review data roles, purposes, retention, and rights.

Read more ExactClose resource

API security

Use explicit scopes and tenant-bound access.

Read more ExactClose resource

System documentation

Trace the product boundary and evidence model.

Read more
From evidence to conclusion

Test the workflow with a real closed file.

Run five complete post-close reviews before you commit to software or services.

Create your workspace See exact pricing