GLBA Safeguards Information Security Policy

This Information Security Policy (the “Policy”) implements Unified Loan System’s comprehensive written information security program required by the Federal Trade Commission’s Safeguards Rule under the Gramm-Leach-Bliley Act, 16 C.F.R. Part 314 (the “Safeguards Rule”). It applies to all nonpublic personal information (“NPI”) that Unified Loan System Processes on behalf of its broker tenants in connection with the Service. Each broker tenant is a “financial institution” under the Safeguards Rule and is responsible for its own written information security program; this Policy governs the platform layer of NPI protection.

Unified Loan System designates a Qualified Individual responsible for overseeing, implementing, and enforcing this Policy. The Qualified Individual reports periodically to Unified Loan System’s governing body (the founder, in the case of a single-member entity) on the status of the security program. As of the effective date, the Qualified Individual is Unified Loan System’s founder; this responsibility may be reassigned in writing.

Unified Loan System performs and documents a written risk assessment at least annually, and whenever a material change in operations could affect the security of NPI. The assessment identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of NPI; evaluates the sufficiency of safeguards in place to control those risks; and is used to revise this Policy as needed. Risk-assessment results are retained for at least five (5) years.

Access to NPI is restricted on a least-privilege, need-to-know basis. Production access requires authenticated identity (SSO or hardware-key-backed credentials), authorization explicitly granted by the Qualified Individual, and time-bound elevation for sensitive operations. Tenant-level isolation in the platform ensures that personnel of one broker tenant cannot access another tenant’s NPI. Access privileges are reviewed at least every six (6) months and revoked upon role change or separation.

Unified Loan System maintains an inventory of systems that Collect, Store, Process, Transmit, or Dispose of NPI. The inventory identifies the system, the categories of NPI handled, the data flow, retention class, and the responsible owner. The inventory is reviewed at least annually and updated upon material change.

NPI is encrypted in transit and at rest using industry-standard algorithms (TLS 1.2 or higher for transit; AES-256 or equivalent for rest). Encryption keys are managed via the cloud provider’s managed key service with access logged and audited. Where encryption of particular data fields is infeasible, the Qualified Individual approves and documents the use of effective alternative compensating controls in writing.

Software development follows secure-coding practices, including code review, static analysis, dependency-vulnerability scanning, and pre-deployment testing. Production deployments are version-controlled, reviewed, and signed off. Third-party libraries are inventoried and monitored for advisories.

Multi-factor authentication is required for any individual accessing NPI on behalf of Unified Loan System, except where the Qualified Individual approves and documents the use of reasonably equivalent or more secure access controls in writing. Hardware-key-backed authentication is required for production-system administrative access.

NPI is securely disposed of no later than two (2) years after the last date the information was used in connection with the Service, unless required to be retained by applicable law, legitimate business need, or as otherwise agreed in the MSA or DPA. Disposal procedures render the information unreadable, indecipherable, and unable to be reconstructed.

Material changes to the platform’s information systems are evaluated against this Policy before deployment. Changes to NPI-handling components require approval by the Qualified Individual. Production changes are version-controlled with attribution, timestamp, and a reversion path.

Unified Loan System monitors the activity of users authorized to access NPI and logs key security and access events. Logs are retained for at least one (1) year and reviewed periodically by the Qualified Individual for anomalies. The Service maintains audit trails of NPI-accessing operations at the broker-tenant level so that tenants can respond to their own regulatory inquiries.

All Unified Loan System personnel with access to NPI receive security-awareness training at the time of hire and annually thereafter. The Qualified Individual evaluates the adequacy and currency of training in light of evolving risks.

Unified Loan System selects service providers capable of maintaining appropriate safeguards for NPI; requires service providers by contract to implement and maintain such safeguards; and periodically assesses service providers based on the risk they present and the continued adequacy of their safeguards. A current list of subprocessors is maintained at unifiedloansystem.com/sub-processors.

The Qualified Individual evaluates this Policy at least annually, and upon material change to the platform’s operations or the threat environment. Adjustments are documented and communicated to relevant personnel.

Unified Loan System maintains a written incident-response plan with the following components: internal response process; roles and responsibilities; external and internal communications; documentation and reporting requirements; and post-incident evaluation and remediation. Following a Security Incident affecting NPI, Unified Loan System notifies affected broker tenants as required by the DPA without undue delay, and supports tenants in their downstream regulatory and borrower notification obligations.

The Qualified Individual prepares a written report at least annually to the governing body of Unified Loan System, covering: the overall status of the information security program; material matters relating to the program (including risk assessment, results of testing and monitoring, security events, recommendations for changes to the program); and any service-provider arrangements requiring attention.