Proof / Security

SOC 2 aligned. PII protected. Fully auditable.

Enterprise security isn't optional in mortgage. inflooens is built with security controls at every layer, not bolted on after the fact.

Security Principles

Security by design

Four principles that guide every architecture decision.

Defense in Depth

Multiple layers of security controls at every tier of the architecture.

Least Privilege

Users and systems only have access to data they need for their role.

Audit Everything

Complete audit trails for all data access and modifications.

Secure by Default

Security controls are enabled by default, not opt-in.

Access Controls

Salesforce security model enforced

All code respects Salesforce's native security controls.

CRUD Enforcement

All Apex code runs with CRUD checks. Users cannot read, create, update, or delete objects they don't have access to.

Enforced

FLS Enforcement

Field-Level Security respected on all queries. Sensitive fields hidden from unauthorized users.

Enforced

Sharing Mode

All queries run with sharing enforced. Users only see records they have access to via role hierarchy, sharing rules, or ownership.

Enforced

Profile/Permission Sets

Granular permissions configured per role. Separate profiles for LOs, Processors, Managers, Admins.

Configurable
PII Protection

Sensitive data handled with care

Mortgage data is sensitive. We treat it that way.

PII Never Logged

Social Security Numbers, account numbers, and other PII are never written to debug logs, error logs, or audit logs.

Masked in UI

SSN displayed as ***-**-1234 in all UI components. Full SSN only visible with explicit permission.

Encrypted at Rest

Salesforce Shield encryption available for sensitive fields. AWS data encrypted with AES-256.

Encrypted in Transit

All API calls over HTTPS/TLS 1.2+. No plaintext transmission of sensitive data.

AI and PII

When Luna analyzes loans, PII is sent to the AI backend for analysis but is never persisted. The AI processes data in memory and returns results. No customer data is used for model training. No PII is logged.

Compliance

Built for regulated industries

Architecture designed with mortgage compliance requirements in mind.

SOC 2 Type II

Aligned

Practices aligned with SOC 2 security, availability, and confidentiality criteria.

GLBA

Compliant

Gramm-Leach-Bliley Act requirements for financial data protection.

CCPA

Compliant

California Consumer Privacy Act data handling and disclosure requirements.

State Mortgage Regs

Supported

Architecture supports state-specific mortgage regulatory requirements.

Audit Trails

Complete visibility into every action

Mortgage compliance requires knowing who did what, when. inflooens maintains comprehensive audit trails leveraging Salesforce's native audit capabilities plus custom logging for AI and integration activity.

Request Audit Documentation

Audit Capabilities

  • Login history with IP tracking
  • Record modification history
  • Field-level change tracking
  • Setup change audit trail
  • API access logs
  • Luna AI conversation logs
  • Encompass sync audit trail
  • Credit pull request logs
User Management

Role-based access control

Different roles see different data. Configured, not coded.

Loan Officers

See own pipeline, leads, and loans. No access to others' data unless shared.

Processors

See assigned loans. Access to conditions, documents, credit. Limited lead access.

Managers

See team pipelines, reports, dashboards. No direct record modification unless needed.

Admins

Full system access. Setup changes tracked. Two-factor authentication required.

Need security documentation?

We can provide detailed security documentation, architecture diagrams, and compliance questionnaire responses for your security review.

Request Security Documentation