For your vendor review
Security
Where this runs, what it holds and does not hold, who can reach it, and what is not in place yet. Each line was checked against the code or the provider's own documentation, and anything that waits on the owner is marked.
Checked November 11, 2026.
In short
The Lender Report publishes public data about lenders and sells labeled ads and page tools. It holds no data about your customers and connects to none of your systems. It takes no borrower financial data: no Social Security or tax ID numbers, no bank or card numbers, no credit scores, no income or revenue figures, and no loan files. What it holds about your institution is an account: the work email addresses, names and titles of the people you add, and what you write on your page and in your ads.
There is no SOC 2 report yet, and no certificate of insurance. They are listed below with the other things that are not in place, so a reviewer does not have to look for them.
What is in place, and what is not
Checked November 11, 2026
| Item | Status | Detail |
|---|---|---|
| Hosting | In place | The site runs on Cloudflare: Pages and Workers serve it, and D1 databases hold the data. We run no servers of our own. |
| Encryption in transit | In place | HTTPS only, with a strict transport security header. Browsers are told never to use plain HTTP for this site. |
| Encryption at rest | In place, at the provider | Cloudflare states that every object stored in D1 and in R2 is encrypted at rest with AES-256, and that data moves over TLS. That is Cloudflare's statement in its D1 and R2 data security documentation, read November 11, 2026. We do not hold the keys. |
| Sign-in | In place | No passwords. A six-digit code is emailed and works for 10 minutes. We store only a keyed hash of it, and five wrong guesses delete it. Requests are rate limited by address and by network. A session lasts 30 days in a cookie that scripts cannot read, and we store only a hash of its token. API keys are stored as a hash and cannot be shown again. |
| Who can do what | In place | Managers of a lender page, named reviewers at the lender, and the account owner have separate rights. A reviewer cannot sign off an ad they wrote. Someone other than the person who wrote a line must sign it off. |
| Our own review list | In place | A person reviews everything a lender writes before it goes live, and each decision is recorded with the reviewer's name and the time. The review list opens only with a key held by the people who review. Every call to it, a read as much as a write, and every refused guess at the key is written to a log with the route, the name the caller gave and the time. |
| Logs and records | In place | Every change to a lender page is recorded with who made it and when. Every ad version, sign-off and takedown is recorded the same way, in a chain of fingerprints that shows if an old record is changed. The service strips any email address from what it logs before a line is kept. |
| Ad proof archive | Not yet in place | Proofs of what an ad looked like are meant to go to a Cloudflare R2 bucket with a deletion lock. The bucket is created at go-live, and in production an order is refused until it is bound. In preview the proofs sit in the database. |
| Other companies on the site | In place | The site loads no analytics, advertising or tracking tool, and no script, font or image from another company. A content security policy restricts every page to its own origin. The only counts are daily totals kept in our own database, with no cookie, address or identifier. |
| Payments | Built, not connected in preview | Card and bank details are entered on Stripe's own pages. We never see or store them. We keep Stripe's customer and subscription numbers. Billing connects when the account is live. |
| Built, not connected in preview | Sent through Cloudflare Email Sending. While the site is in preview, no email is sent at all. | |
| Backups and recovery | In place at the provider. Our own procedure: not yet in place | Cloudflare states that D1 Time Travel is always on and can restore a database to any minute within the last 30 days. We have not written a backup and recovery procedure, and we have not rehearsed a restore. |
| Subprocessors | In place | Cloudflare, Inc. (hosting, databases, file storage, email sending). Stripe, Inc. (card and bank payments) is added when orders open; nothing is on sale yet. Cloudflare hosts and stores it. The operator keeps waitlist entries and financing requests in its own records and does not sell or share them, as the Privacy Policy says. |
| Security contact | In place | Write to desk@lender.report with Security in the subject. A person reads it. We have not set a response time. |
| Incident response plan and notice period | Not yet in place | We have no written incident response plan and have not set a number of hours for telling you of an incident. |
| Written staff access policy | Not yet in place | Who on our staff may read the databases is not written down as a policy. No sales role exists, and the review list opens only with a key held by the people who review. |
| Test by an outside firm | Not yet in place | No outside firm has tested the site. An internal review of the code was done on November 8, 2026. It was not an independent audit. |
| SOC 2 report | Not yet in place | We have no SOC 2 report. We will not imply one exists. Cloudflare and Stripe publish their own certifications on their own sites. |
| Certificate of insurance | Not yet in place | We hold no certificate of insurance. Cover for media liability, technology errors and omissions, and cyber risk waits on the owner and is not in place. |
| Completed security questionnaire | Not yet in place | We have not completed one. We will answer yours in our own format, and say so where an answer is not yet. |
What we hold, and what we do not
We hold
- Public data from regulators and government files. None of it is secret.
- For each person on an account: a work email address and, for a lender page, a name and job title, a role, and hashes of the sign-in code and the session.
- What you write on your page and in your ads, and the record of who changed what and when.
- Orders: what was bought, the price and term, the signer's name and title, a PO number if you give one, and a billing email address.
- Stripe's customer and subscription numbers. Not card or bank details.
- Daily totals of page views and ad views, with no identity attached.
- Waitlist entries: a work email address, the lender, the product, and a market and a note if given. Kept until the product opens plus 12 months, and never longer than 24 months.
- Financing requests sent to this site's operator through its own form: what the loan is for, the state, an amount range, timing, names, a work email address, a phone number if given, and a note. Kept 24 months, then deleted. They are not sent to any lender. We do not store an IP address: with a financing request or a message to a lender we keep a keyed hash of it and of the browser's user-agent for abuse control, and delete both after 90 days.
- Messages a visitor sends you through the contact form on your Verified (paid) page: the visitor's name, work email, phone if given, state, amount range and message. Delivered to the address you chose. We keep the message text for 90 days, then only the date and a delivery record.
- Correction requests and requests to remove or correct a listing of a person: the page, what was asked, and an email address if one was given. Kept 24 months.
We do not hold
- Anything from your own systems about your customers or borrowers.
- Social Security or tax ID numbers, bank account or card numbers, bank statements, credit scores, income or revenue figures, or dates of birth. The site checks for them and refuses them in search, in the API, in lender content, in claims, in saved lists and notes, in problem reports and in ads.
- Documents. The one file a lender can upload is its logo, a PNG or WebP of 64 KB or less, which a person looks at before it is shown.
- Deal files, term sheets or loan files of any kind. There are no deal rooms and no file uploads. Two forms carry a visitor's request: the site's own financing form, and the contact form on a Verified (paid) lender's page, which goes to that lender only.
- Passwords. There are none.
- Any access to your network, your systems or your online banking. We need none and ask for none.
Sign-in codes last 10 minutes and sessions 30 days. An account stays while you hold it. Ad records are kept for the life of the account and seven years after, which is our choice and not a rule. The privacy policy says who can ask us to export or delete what, and how. Lender managers are verified again every 12 months and whenever their domain changes.
Report a problem, or ask a question
Write to desk@lender.report with Security in the subject. Please do not send personal or financial information. If you ask for our answers to a vendor questionnaire, send it and we will fill it in our own format and mark what is not yet. Documents are listed in the vendor packet.