Built for what's at stake.

Compliance at a glance

• GLBA Safeguards Rule

  Aligned · WISP documented

  Live

• Record retention schedule

  Loan files 5 years after the loan is closed, withdrawn or denied; audit log 7 years (Cinch policy). Scheduled deletion and legal holds in progress.

  Coming soon

• Borrower self-service data export

  Borrowers download their own data from the portal

  Live

• SOC 2 Type II

  Audit underway, 2026

  Coming soon

• Annual third-party penetration test

  2026

  Coming soon

Tenant isolation

How

Every loan, document and borrower lookup is scoped to your brokerage, and anything that isn't yours reads as not found, the same answer as a record that doesn't exist. Every change checks the brokerage again in the statement that writes it. Postgres row-level security policies are defined as a second layer, but the app's database role bypasses them today, so the scoping in each query is what keeps brokerages apart.

Verify

Every Server Action follows the shape documented in AGENTS.md: a lookup scoped to the brokerage, then a compare-and-swap update scoped the same way. The policies: drizzle/migrations/0001_rls.sql.

Encryption

At rest

Social Security numbers and dates of birth are encrypted field by field with AES-256-GCM before they reach the database, and each stored value names the key that encrypted it. In progress: moving those keys into AWS KMS — a data key per brokerage, each value bound to its brokerage and borrower record, every key use logged in CloudTrail. It goes live in each environment as its key is provisioned. Not yet field-encrypted: account numbers and income figures read from uploaded documents.

In transit

TLS 1.3 end-to-end. HSTS preload-list submission planned for cinch.app. No legacy TLS 1.0/1.1 fallback.

Verify

Envelope helper: lib/encryption/envelope.ts. KMS rotation runbook: docs/runbooks/kms-key-rotation.md.

Access and audit

Authentication

Mandatory TOTP MFA for every broker login. Passwordless magic-link invites for new teammates. SSO (SAML/OIDC) on the enterprise tier.

Audit trail

Every read of PII, every document upload, every status change, every email sent — recorded with actor, IP, user-agent, and the structured detail of what was viewed or changed. Kept for 7 years under Cinch's own security policy; no law sets that period.

Verify

Living catalog: tests/integration/audit-log.test.ts — one test per documented audit action (67 logged today; origination and coming-soon features add more). Retention helper: lib/audit/retention.ts.

Retention

Loan files

By default we keep loan files, uploaded documents and borrower messages for 5 years after the loan is closed, withdrawn or denied. Where a brokerage's state requires longer (Vermont requires 6 years), we keep its records for that longer period. That meets the record-keeping minimums we know of for a broker's loan file: for example, 3 to 6 years under state licensing laws, and 25 months after the applicant is told of the decision under the Equal Credit Opportunity Act when the broker takes part in that decision. A loan still open after 1 year without activity, or when its brokerage closes, counts as withdrawn from then, so its period starts on that date. A draft that never became an application is kept for 1 year after its last change.

Audit log

We keep the audit log for 7 years from each event, and an entry about a loan file at least as long as the file itself. That period is our own security policy, not a legal requirement.

Backups and holds

Backups and earlier versions of uploaded files are kept for at most 30 days, so a deleted record is gone from them within about 30 days. Once we know of an investigation, enforcement action or lawsuit, we keep the records it covers until it ends, even past their period.

Deletion

Automatic deletion on this schedule is still being built, and will be running before the first record reaches the end of its period. An owner can delete a brokerage in Settings right away only if it never held borrower records, such as a trial with only sample loans; its stored files go with it and leave our backups within about 30 days. A brokerage that holds loan records is closed through support instead, and its records are kept until their period ends.

Verify

Every record class, with the rule, citation and source behind its period, and the per-state floors: lib/retention/schedule.ts. Audit entries can't be deleted until legal holds and each loan file's retain-until date exist: lib/retention/legal-hold.ts, lib/retention/audit-file-floor.ts. The delete-brokerage gate: lib/retention/brokerage-deletion.ts.

GLBA Safeguards

Cinch is designed to the FTC's Standards for Safeguarding Customer Information (16 CFR § 314), the “Safeguards Rule” under the Gramm-Leach-Bliley Act. Specifically:

Runbooks

Documented playbooks for every realistic incident. Each cross-links to the relevant code paths + audit queries.

• resend-outage.mdWhat to do if email delivery goes down mid-loan.
• audit-replay.mdReconstructing what happened from the audit log.
• sentry-incident.mdTriaging a captured exception with op-tag context.
• ssn-reveal-incident.mdForensic trail when a broker reveals a borrower SSN.
• kms-key-rotation.mdRotating the AES-256 envelope key without breaking decrypt.