Security & Compliance

Data protection

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is role-based and least-privilege — reviewers see only the files assigned to them — and every access and action is logged for audit.

Where your data lives

Choose the deployment that fits your risk posture: our secure managed environment, your private cloud, or fully on-premise. On-premise and private-cloud options keep borrower NPI inside your own perimeter. Client data is logically segregated and never commingled across lenders.

Compliance

Our controls are built around US mortgage and financial-data requirements, including the GLBA Safeguards Rule and applicable state privacy laws. Mortna is powered by Kadel Labs, an ISO 27001-certified, CMMI Level 3 organization; a SOC 2 attestation is in progress. Current certificates and SOC 2 status are shared under NDA during vendor due diligence.

People and process

Reviewers work under confidentiality agreements, complete security and privacy training, and operate with US-business-hours overlap. Changes to systems and access follow documented review and approval.

Insurance

We maintain professional liability (errors & omissions) and cyber-liability coverage. Coverage terms and limits are provided during vendor due diligence and defined in the master services agreement.

Vendor due-diligence pack

InfoSec and vendor-management teams can request our due-diligence pack — security questionnaire responses, policies, certificates, subprocessor list, and insurance certificates — under NDA. If you use a standard assessment such as a SIG questionnaire, send it over and we will complete it.