Security
Built for data you cannot afford to leak
A lending CRM holds your leads, Social Security numbers, bank accounts and statements. Here is what we promise, exactly how we protect it, and what we have not built yet.
Our data promises
In plain words, before the fine print.
- 1
Your leads are never for sale
We never sell, rent, share or broker your leads, merchants or deal data. We never use it to compete with you or to market to your merchants.
- 2
Shared only when you send it
Your data goes to a lender or any other third party only when your team sends a submission. The only other parties that handle it are the subprocessors that run the service.
- 3
Walled off from every other company
Each company's records are isolated from every other customer's. Every query is scoped to your organization, and returns nothing if that scope is ever missing.
- 4
Sensitive fields encrypted and masked
Social Security numbers, dates of birth, EINs, bank account and routing numbers and driver's licence numbers are encrypted at rest and shown masked. Every reveal is recorded in the audit log.
- 5
Encrypted in transit
Every connection to the service, and between our web and API servers, uses TLS.
- 6
Documents kept private
Statements, applications and IDs are stored privately, never at a public link, and served only to signed-in users allowed to see that deal.
- 7
Access by role, every change on the record
Each person gets the access their role allows. Changes, exports, downloads and reveals go into an append-only audit log.
- 8
Export or delete, whenever you ask
Export your lists to CSV at any time. Ask us to delete your data and we will, except what the law requires us to keep. When your account ends, we return it on request and then destroy it.
- 9
Subprocessors in the open
Every service provider that touches customer data is listed, and we announce changes 30 days before a new one starts.
- 10
Staff access only to help you
Our staff open your workspace only to give support or when you ask. When they do, it is logged when they start and stop, and anything they change is marked as done by our staff.
Data protection
Sensitive values are encrypted one by one, shown masked, and revealed only on purpose.
Field-level encryption
Masked, with audited reveal
Private document storage
Encrypted in transit
Nothing sensitive in logs
Locked-down servers
Access control
Each person sees what their job needs, and every organization sees only its own data.
Five roles
- Owner
- Everything, including organization settings and billing.
- Manager
- All records, users and settings except billing.
- Agent (sales rep)
- Their own leads and deals, unless the owner lets agents see everything. Cannot delete records.
- Processor
- Documents, submissions and offers on every deal. Cannot export.
- Read only
- Can view, cannot change anything, reveal sensitive values or export.
Tenant isolation
Accounts and sign-in
Accountability
You can always answer who did what, and when.
Append-only audit log
Sensitive actions logged
Our own access, on the record
Application safeguards
- Rate limits on sign-in, password changes, sensitive-value reveals, public forms and the API.
- Spam protection on every public form, including the merchant application.
- Upload checks on content type and size: statements and documents are PDFs or images up to 25 MB; imports are CSV or XLSX up to 20 MB.
- Safe exports: CSV cells that a spreadsheet could run as a formula are neutralized, and every export is logged with its filters.
- Cross-site request forgery protection on every signed-in request.
- Soft deletes for documents: deleting a document hides it but keeps the file, so nothing disappears by accident.
What we have not built yet
We would rather tell you than have you find out in a questionnaire.
Two-factor sign-in and single sign-on. Not available yet. Use a strong, unique password per user, and deactivate users the day they leave.
SOC 2 or other audit reports. We do not have one. We will answer a security questionnaire on request.
Malware scanning of uploads. Uploads are type- and size-checked, not virus-scanned.
An audit log screen for customers. The log is recorded for every workspace; ask us and we will pull the entries you need.
Responsible disclosure
If you believe you have found a security vulnerability in Ferrylend, please email support@ferrylend.com with the details. We read every report and will reply.
- Describe the issue, the steps to reproduce it and the impact you expect.
- Test only against your own account and data. Do not access, change or delete other people's data.
- Do not run denial-of-service, spam or social engineering tests.
- Give us reasonable time to fix the issue before you share it publicly.
We do not run a paid bug bounty today.
Questions
Do you sell or share our data?
No. We do not sell customer data or use it for advertising. We share it only with the service providers that run the product, listed in our data processing addendum.
Who on our team can see a merchant's SSN or bank account number?
Nobody sees the full value by default: it is shown masked. Owners, managers, agents and processors can reveal it when they need it; read-only users cannot. Every reveal is recorded with who, when and from where.
Is AI used on our data?
Only if your workspace turns on AI bank statement parsing. When it is on, the statement PDFs you choose to parse are sent to Anthropic's API to extract the monthly figures. Nothing else is sent, and nothing is sent when the feature is off.
Where is our data stored?
On servers in an Amazon Web Services data center in the United States. Uploaded documents are stored privately on the application server, never in a public bucket.
Can we get our data out?
Yes. Every list in the app (leads, merchants, deals, lenders, submissions, funded deals, commissions, tasks, users) exports to CSV, for users with export permission. Exports are logged.
Do you have a SOC 2 report or fill in security questionnaires?
We do not have a SOC 2 report. We are happy to answer a security questionnaire or walk your team through how the product handles data: contact us.