Security Policy
This policy summarizes the technical and organizational measures that protect customer and borrower data on the LoanPacket platform.
Certifications
SOC 2 Type II report covering security, availability and confidentiality. ISO 27001 certification. Annual third-party penetration testing.
Encryption
AES-256 encryption at rest for all documents and databases. TLS 1.3 in transit. Customer-managed encryption keys available on High-Volume plans.
Access control
Role-based access, SSO via SAML and OIDC, mandatory multi-factor authentication for LoanPacket staff, and least-privilege production access with session recording.
Vulnerability disclosure
Report vulnerabilities to security@loanpacketapp.com. We acknowledge within one business day and provide status updates until resolution. See /.well-known/security.txt.
Incident response
Documented incident response plan with customer notification within 72 hours of a confirmed breach affecting their data.