Trust & Security

Security & Data Handling

Last updated: July 6, 2026

You’re a regulated lender, and loan-level data is nonpublic personal information under GLBA. This page answers the questions your compliance officer will ask — in writing, before they have to ask them.

Read-only by architecture

Underbot connects to your LOS and LMS with read-only credentials. We never write to your systems of record — not a field, not a flag. You remain the system of record; Underbot is the intelligence layer on top.

Encryption

Data is encrypted in transit using TLS and encrypted at rest on our managed cloud infrastructure. Anonymized teardown files are handled the same way from the moment they arrive.

GLBA & NPI handling

We treat loan-level data as NPI under the Gramm-Leach-Bliley Act. Nothing moves before a mutual NDA is signed. The free teardown runs on roughly 15 anonymized fields with zero PII — your team strips identifiers in-house before anything leaves your building. Production integrations operate under a written agreement that governs permitted use, retention, and return or destruction of your data.

Your data never trains AI models

We do not use your data to train or fine-tune AI models — ours or anyone else’s — and our model providers are contractually prohibited from training on it. Your book is your competitive edge; it stays that way.

Access control & tenancy

Each lender’s data is logically isolated per tenant. Access within Underbot is limited to the personnel who need it to operate your deployment, and portal access on your side is authenticated per user.

SOC 2

Our controls are built to SOC 2 standards, and a formal SOC 2 Type II audit is on our security roadmap. Ask us where we are — we’ll give you a straight answer, not a badge.

Data processing agreement

A DPA is available on request and can be executed alongside your pilot agreement. Ask and it’s in your inbox the same day — the same promise we make on the NDA.

Questions or concerns

Underbot AI LLC · hello@underbot.ai