Masked values and reveals
The most sensitive values are stored encrypted and shown masked, with only the last four characters visible:
- On owners: Social Security number, date of birth, driver's license number.
- On merchants: EIN.
- On bank accounts: routing and account numbers.
Owners, managers, agents and processors see an eye button next to a masked value (its tooltip reads "reveals are audit-logged"). Clicking it shows the full value for 30 seconds, then masks it again. Each reveal is recorded with who did it, on which record, and when. Read-only users cannot reveal. Agents can only reveal values on records they can see.
Reveal only when you need the value right now (filling a lender portal, a verification call), and never copy it into a note, a task or an email. Notes are not encrypted.
What is recorded
Behind the scenes the CRM keeps an append-only audit log. Nobody in your organization can edit or delete entries. It records:
- Every create, update and delete on leads, merchants, owners, bank accounts, deals, documents, submissions, offers, funded deals, commissions, tasks, lenders and settings, with the fields that changed. Sensitive fields are written as "[redacted]", so the log itself never holds them in clear text.
- Sign-ins, sign-outs and password changes.
- Every reveal of a masked value and every document download.
- Every CSV export, with the filters used.
- Stage overrides (Move anyway), pricing locks and unlocks, completed imports, commission receipts, disputes, clawbacks and payouts.
Deleted leads disappear from lists and reports, but their history stays in the log. If our support team ever opens your workspace to help you, that access, and every change made during it, is recorded too.
Viewing the log
There is no screen in the app for browsing the audit log today. The day-to-day history of a record is its Activity timeline. If you need to know who changed, revealed or exported something, contact support with the record and the rough date.
Exports
Owners, managers and agents can export lists to CSV; processors and read-only users cannot. Exports never include the encrypted values, agents export only records they can see, and cells a spreadsheet could run as a formula are neutralized so the file is safe to open. Each export is recorded.
Good practice for owners
Checklist
0 of 6Questions
Can owners see who revealed a Social Security number?
Every reveal is recorded with the user, the record and the time. There is no in-app screen for browsing the audit log today, so contact support with the record and approximate date and they can tell you what was recorded.
Try it in the app
Signed in? Open the screen this lesson covers.
Finished this lesson?
0 of 12 lessons in Owner and admin setup
Progress is saved in this browser. Sign in to keep it across devices.
Related lessons
- Compliance basicsHandling SSNs, bank numbers and IDsA checklist for the sensitive data in every lending file: collect less, mask it, restrict and log access, keep it only as long as needed, then delete it.
- Compliance basicsRecordkeeping checklist for every dealWhat to keep on each deal so you can answer a merchant, funder or regulator: application, consents, disclosures, statements, offers, contracts and messages.
- Start hereRoles and permissionsThe five roles in plain language: owner, manager, agent, processor and read only. Who sees which records, who can reveal sensitive values and export.
- Underwriting and analysisDecision notes and the audit trailWrite the underwriter's notes, decide conditions, record decline reasons and know which actions the CRM logs, so every decision on a file can be explained.
- Help centerRoles and permissionsWhat owners, managers, agents, processors and read-only users can see and do.
- Help centerExport your dataDownload any list to CSV with its current filters, and what you need to know about permissions and sensitive fields.