Cleared2Close is built to protect lending CRM records, borrower and referral partner data, client documents, e-signature packets, reports, videos, and workflow data for mortgage teams.
Application Security
Production traffic is served over HTTPS. Secure cookies, optional authenticator app MFA, HSTS, CSRF protection, clickjacking protection, noindex controls for private CRM pages, and browser security headers are enabled. Customer media is not served through a public media directory; private uploads are checked by application-level access controls.
Data Protection
OAuth tokens and saved integration credentials are encrypted at rest with a dedicated field-encryption key. New team API keys are shown once and stored as hashes. Borrower and contact document uploads are encrypted by the application file-storage layer for new uploads and are served only through protected media routes. Data exports exclude passwords, OAuth tokens, and raw API keys.
Borrower Portal Documents
The client loan tracker requires a unique portal token plus an access code before borrowers can view the file tracker or upload requested documents. Uploaded borrower documents are validated by type and size, stored as private contact documents, scoped to the lending team, and checked before download. Portal pages are marked noindex/nofollow.
Documents and Signatures
Signature documents are team-scoped. Signer links use unique tokens, optional access codes, audit events, signed PDF hashes, and document seals. Sensitive document views and downloads are logged for audit review.
Uploads
Uploads are restricted by type and size, executable formats are blocked, and supported files are checked with content-type and file-signature validation. Production upload malware scanning is enabled and required for supported upload paths.
Backups and Monitoring
Production database and media backups are maintained on a scheduled basis. Application health checks, Sentry error monitoring, and server-health snapshots are used to detect reliability and security issues.
Support Access
Support-console access is limited to authorized staff accounts, and support-console views and sensitive support actions are logged. Customers can request data exports and deletion review from the Data & Privacy settings page.
Responsible Disclosure
If you believe you found a security issue, email support@cleared2close.app with a concise description, steps to reproduce, and any relevant URLs or screenshots. Please do not access, modify, or download data that is not yours.