What we do with your data.

Who we are

Cinch is a software platform used by US mortgage brokers to collect borrower documents and manage loan files. Brokers are our customers; their borrowers are the data subjects whose information flows through Cinch.

For purposes of US privacy law, brokers are the “controllers” of borrower data; Cinch is a “service provider” (CCPA terminology) or “processor” (similar concepts in other states). We process borrower data only on the broker's instructions, and we don't sell or share it for cross-context advertising.

What we collect

From brokers: name, work email, brokerage name, role within the brokerage, NMLS ID, MFA enrollment timestamp, IP and user-agent on each sign-in.

From borrowers: name, email, phone, optionally Social Security number and date of birth, plus any documents the borrower uploads (paystubs, bank statements, tax returns, IDs, etc.). Borrowers also generate IP and user-agent records on each portal visit.

We do not collect: payment card data, biometric data, geolocation beyond IP-derived city, social-graph data, browsing history from other sites.

How we protect it

Encryption. All data in transit uses TLS 1.3. The most sensitive PII — Social Security numbers and dates of birth — is additionally encrypted, field by field, with AES-256-GCM before it's stored. We're moving the keys for those fields into AWS KMS, where their use is limited by IAM policy and logged. Account numbers read from uploaded documents aren't field-encrypted yet.

Tenant isolation. Every loan, document and borrower lookup is scoped to your brokerage, and anything that isn't yours reads as not found. Every change checks the brokerage again in the statement that writes it.

Access controls. Mandatory TOTP MFA for every broker login. Brokers control who in their organization sees what via role-based access.

Audit trail. Every read of PII, every document upload, every status change — recorded with actor, IP, user-agent, and the structured detail of what was viewed or changed. Kept for 7 years under our own security policy (see Retention below).

See the security overview for code-level detail.

Sub-processors

Cinch uses a small set of third-party services to deliver the platform. Each is a sub-processor under the GLBA Safeguards Rule and equivalent state laws.

• SupabaseAuthentication + managed Postgres databaseUS (Vercel-aligned regions)
• AWSS3 (encrypted document storage), KMS (encryption keys)us-east-1
• AnthropicAI document validation (Claude API)US
• ResendTransactional email deliveryUS/EU
• TwilioSMS deep links to borrowersUS
• VercelApplication hosting + CDNMulti-region
• SentryError monitoring (PII-scrubbed)US

We notify brokers before adding new sub-processors that have access to borrower data. Brokers can object to a new sub-processor by terminating their account.

Your rights

Borrowers have the right to:

Access

Download a copy of your information as JSON from your portal, with no broker handover required. To protect you if your link is ever forwarded, the download shows only the last 4 digits of your Social Security number and leaves out your date of birth.

Correct

Update your contact info from your portal. Ask your broker to correct anything else; brokers can edit on your behalf via Cinch.

Delete

Ask your broker. Brokers must keep mortgage application records for periods the law sets (for example, 3 to 6 years under state licensing laws, and 25 months after you're told of the decision when the broker takes part in it), so some records can't be deleted until that period ends. Cinch deletes a record once its period in our retention schedule ends; that automatic deletion is still being built.

Object

If you object to specific processing, contact your broker. We act on broker instructions; the broker is the controller of your loan file.

Portability

Your data export is in standard JSON — directly machine-readable by any other tool that wants it.

Retention

We keep each kind of record for a set period in our written retention schedule, then delete it securely. The periods are set to meet the federal and state record-keeping minimums we know of for mortgage brokers. Automatic deletion on this schedule is still being built, and will be running before the first record reaches the end of its period.

Loan files, documents and messages: By default we keep loan files, uploaded documents and borrower messages for 5 years after the loan is closed, withdrawn or denied. Where a brokerage's state requires longer (Vermont requires 6 years), we keep its records for that longer period. That meets the record-keeping minimums we know of for a broker's loan file: for example, 3 to 6 years under state licensing laws, and 25 months after the applicant is told of the decision under the Equal Credit Opportunity Act when the broker takes part in that decision. A loan still open after 1 year without activity, or when its brokerage closes, counts as withdrawn from then, so its period starts on that date. A draft that never became an application is kept for 1 year after its last change. A brokerage can ask us to keep its records longer, but not to delete borrower records before their period ends.

Audit log: We keep the audit log for 7 years from each event, and an entry about a loan file at least as long as the file itself. That period is our own security policy, not a legal requirement.

Backups: Backups and earlier versions of uploaded files are kept for at most 30 days, so a deleted record is gone from them within about 30 days.

Legal holds: Once we know of an investigation, enforcement action or lawsuit, we keep the records it covers until it ends, even past their period.

When a brokerage leaves: When a brokerage cancels, we first give it a copy of its loan files and audit log. We then keep its records until their period in our retention schedule ends and delete them securely; a loan still open at cancellation counts as withdrawn that day. An owner can delete a brokerage in Settings right away only if it never held borrower records, such as a trial with only sample loans; its stored files go with it and leave our backups within about 30 days. A brokerage that holds loan records is closed through support instead, and its records are kept until their period ends.

Our full retention schedule, with the rule behind each period, is available on request at privacy@cinch.app.