Honest compliance posture, with no marketing badges we haven't earned.

Regulatory alignment for mortgage capital markets

The platform's audit, retention, and access controls are designed against the regulatory environment its customers live in: GLBA Safeguards Rule for non-public personal information, CCPA / CPRA for consumer rights, HMDA- relevant audit trails on the data we touch, and ECOA-aligned non-discrimination in pricing. We do not represent that the platform itself is HMDA-compliant — compliance is the lender's responsibility — but the audit chain and historical replay are designed so that compliance teams can produce evidence quickly.

HMDA / ECOA support

The audit chain captures every pricing decision with the inputs and the ratesheet version that fired. Historical replay (as-of pricing) reproduces past quotes deterministically. ECOA non-discrimination depends on the rules you configure; the rule engine itself does not consider protected characteristics. Operators can audit rules for prohibited bases by inspecting the program eligibility table directly.

URLA 2021 + multi-borrower

URLA 2021 Tiers 1–5 ship complete. The platform models multiple borrowers via a unified borrowers[0..N] namespace — index 0 is the primary, indices 1+ are co-borrowers, all with identical field shapes. This eliminates the MISMO container aliasing that historically drove co-borrower data drift. Tier 5 fields (REO, close-out structure, 2021 marital and income enums) are first-class.

Property warrantability + ULDD

Property fields decompose into Fannie ULDD orthogonal axes (category, attachment, ownership, project type, structure, construction method, stories) with confidence scoring. Warrantability classification (WARRANTABLE / NON_WARRANTABLE / UNKNOWN) ships with an English-language rationale citing the contributing fields. The decomposition and warrantability call are audit-chained; operator overrides capture prior + new values.

Delegation evidence (actingAsOrgId)

Every cross-tenant action — pricing, locking, sharing — writesactingAsOrgId into common_audit_log. Wholesale and TPO audits get unambiguous evidence of who initiated each request under whose delegation grant. This holds across white-label deployments; the brand layer does not muddle the audit chain.

State-specific overlays

State-level regulatory overlays (e.g., New York high-cost loan thresholds, California consumer privacy specifics) are configured as eligibility rules and audit annotations. The platform does not ship state-specific compliance defaults — operator configuration is required.

Audit evidence

We support customer audits within reason — once or twice per year for Business and Enterprise tiers, scoped to a documented set of evidence, conducted under NDA. Evidence packets typically include: the SOC 2 report (when available), control mappings against the customer's framework of choice, sample audit-log extracts demonstrating hash-chain integrity, ratesheet ingestion lineage, and infrastructure architecture diagrams.

Sales coordinates audits via the assigned CSM; we do not allow ad-hoc audits without coordination. This is how we keep the platform stable under audit pressure.