Security
Security and privacy
Borrower documents are sensitive. This page says plainly how they’re handled today and how to reach us. We’d rather be accurate than impressive.
Our approach
- AI suggests, a person approves. Values read from documents are for you to check.
- The minimum data. We only ask for and keep what the work needs.
- Plain facts. This page only describes what the product does today.
Where borrower documents go
These services process borrower information when the app is used:
| Service | What it receives | Why | Where |
|---|---|---|---|
| Google Cloud (Vertex AI) | While a borrower uploads: each file (first 3 pages), the applicants' names, the loan purpose and income types | Recognize each document and sort it into the broker's checklist; the result isn't stored | Canada (Montréal) |
| Anthropic (Claude, backup reader) | Only when Vertex refuses, fails or times out: the same document and context Vertex would have read | Read the document so the broker is not kept waiting | United States |
| Google Cloud (Vertex AI image generation) | No personal information: a city or neighbourhood name and a description of a scene (a street, a home), when a broker asks for a sample photo for their website | Make sample photos for brokers' websites | Google's global network (outside Canada) |
| Google Cloud (Cloud Storage) | Submitted documents and application details (names, emails, phone numbers, income types, notes, consent); broker profile photos | Store each submission for the broker | Canada (Montréal) |
| Resend (email) | Broker names and emails for sign-in links; submission emails to the broker with client names, emails, phone numbers, file names and notes | Send sign-in links and tell the broker when documents arrive | United States |
| Supabase (database) | Broker accounts and profiles, encrypted Finmo credentials, sign-in sessions, audit and delivery records, encrypted copies of delayed submissions, brokers’ client lists (client names and broker notes encrypted; email and phone only as keyed hashes) | Run broker accounts and deliver submissions | Canada (Central) |
| Google Cloud (Cloud Run, app hosting) | All app traffic, including uploads in transit, and server logs | Run the app | Canada (Montréal) |
| Cloudflare (network in front of the app) | All app traffic, including uploads in transit, on its way to the app | Route visitors to the app and protect it from abuse | Cloudflare's global network |
| Google (Google Fonts) | IP address and browser details of anyone who opens the app | Load the app's fonts | Google's global network |
| Finmo | Borrower details and documents, when the broker sends a file | Fill in the broker's Finmo deal, using the broker's own credentials | Canada, according to Finmo |
| Finmo (read back, Pro brokers who switch it on) | After the broker pulls credit in Finmo: the borrowers' credit scores, the debts on the credit report, and the deal's price, down payment and income as Finmo holds them. Stored as figures and counts only (no creditor, account number or name); the deal page and the broker's "credit pulled" email are computed from them | Check the client's debt ratios against lender limits again with the credit report's figures, and remove the portal's own duplicate debt entries from the Finmo deal | Canada (Cloud Run and the database in Montréal) |
| Google Drive (the broker's own, if they link it) | A copy of each client's documents, in a folder BrokerMate creates in the broker's Drive | Give the broker a copy in their own Drive; BrokerMate's storage in Canada stays the system of record | Outside Canada (Google's global storage) |
Today
-
Each submission is kept separate
Borrowers upload through your link, and each submission is delivered as its own package, named for its applicants.
Your responsibilities as the broker
Privacy contact
Questions about personal information: Arash Zare, President, info@thebrokermate.com.
Report a security problem
Email info@thebrokermate.com. Please include what you found, how to reproduce it, and any accounts or URLs involved. Don’t include borrower documents or personal information.
We’ll acknowledge your report and keep you updated. We won’t pursue legal action against good-faith research that avoids harming people’s data and gives us reasonable time to fix the problem.
Machine-readable contact: security.txt