Before entering income, tax, identification, or loan documents into an AI mortgage assistant, ask the provider nine specific questions about collection, use, sharing, model training, safeguards, retention, incidents, and decision-making. Get the answers in the lender’s current privacy notice or AI/vendor disclosure, not only in a chat response.
No unnamed assistant can be labeled safe or unsafe without its current disclosures and contracts. Use the checklist below to determine what the system receives, who can access it, how long records remain, and what recourse you have if an answer or decision is wrong.
As an Amazon Associate I earn from qualifying purchases.
Why a mortgage assistant needs a higher privacy standard
Mortgage conversations contain more than ordinary contact details. The Federal Trade Commission’s Gramm-Leach-Bliley Act (GLBA) guidance treats information supplied to obtain a financial product, data from a transaction, and information obtained while providing the service as nonpublic personal information (NPI). Applications can therefore include identity data, income, assets, debts, credit information, property details, account numbers, uploaded statements, and the text of your questions.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →GLBA applies to covered financial institutions that offer loans. The FTC says those institutions must explain information-sharing practices and safeguard sensitive information. Its Safeguards Rule guidance specifically lists mortgage lenders and mortgage brokers as examples of financial institutions and describes written security programs with administrative, technical, and physical safeguards. Coverage and exact duties depend on the entity and the circumstances, so ask the lender how its AI provider is governed rather than assuming the technology vendor has identical direct obligations.
#1 Best Overall
- PORTABLE SCANNER FOR USE ON-THE-GO — The fastest and lightest mobile single-sheet-fed compact document scanner in its class¹
- QUICK DOCUMENT SCANNING ― This Epson ultra-fast scanner scans a single page as quickly as 5.5 seconds²; Windows and Mac compatible
- VERSATILE PAPER HANDLING ― Portable scanner scans documents up to 8.5 x 72 in; Also easily digitizes receipts and ID cards to make accounting, bookkeeping, and organizing simpler
- INTUITIVE, HIGH-SPEED SOFTWARE — Epson ScanSmart Software³ is a smart tool allowing you to easily scan, review, and save; Stay organized easily with the help of this Epson scanner
- EASY SETUP — USB-powered connect to your computer for quick and simple scanning; No batteries or external power supply required to operate portable document scanner; Standard Connectivity: USB 2.0
Fannie Mae’s Selling Guide section A3-4-01, dated February 5, 2025, requires covered sellers and servicers to protect confidential information, follow applicable privacy laws, limit disclosure, and securely dispose of information. It says disclosure of borrower NPI generally requires borrower authorization unless applicable law permits it. That is a requirement in Fannie Mae’s business relationship, not proof that every lender or assistant follows the same contract.
The nine questions to ask before submitting anything
1. What information does the assistant collect?
Ask for a complete inventory, not a description such as “the information needed to help you.” Confirm whether collection includes:
- Prompts, follow-up messages, conversation transcripts, timestamps, device or browser data, and usage or diagnostic logs.
- Files you upload, including tax returns, pay statements, bank statements, identification, insurance records, and property documents.
- Information copied from your mortgage application, customer account, credit file, public records, cookies, or other connected systems.
- Derived records such as summaries, extracted fields, risk flags, embeddings, or profiles created from your documents.
Ask whether optional fields are collected even when you do not submit them, and whether a human can see the entire conversation. Request a written data-flow diagram or plain-language explanation identifying each source and each resulting record.
2. What are the purposes of each use?
Require the provider to separate uses that are necessary to answer your current question from secondary uses. Possible purposes include answering questions, preparing or servicing a loan, identity and fraud controls, security monitoring, analytics, quality assurance, product improvement, and developing or evaluating models. Ask whether refusing a secondary use changes your eligibility for the mortgage or only limits a feature.
A precise answer should identify the legal or contractual basis for each purpose, the business unit responsible, and whether the purpose continues after your application closes or your loan is paid off.
Rank #2
- FAST SPEEDS - Scans color and black and white documents a blazing speed up to 16ppm (1). Color scanning won’t slow you down as the color scan speed is the same as the black and white scan speed.
- ULTRA COMPACT – At less than 1 foot in length and only about 1. 5lbs in weight you can fit this device virtually anywhere (a bag, a purse, even a pocket).
- READY WHENEVER YOU ARE – The DS-640 mobile scanner is powered via an included micro USB 3. 0 cable allowing you to use it even where there is no outlet available. Plug it into you PC or laptop and you are ready to scan.
- WORKS YOUR WAY – Use the Brother free iPrint&Scan desktop app for scanning to multiple “Scan-to” destinations like PC, Network, cloud services, Email and OCR. (2) Supports Windows, Mac and Linux and TWAIN/WIA for PC/ICA for Mac/SANE drivers. (3)
- OPTIMIZE IMAGES AND TEXT – Automatic color detection/adjustment, image rotation (PC only), bleed through prevention/background removal, text enhancement, color drop to enhance scans. Software suite includes document management and OCR software. (4)
3. Will prompts, transcripts, documents, or derived data train an AI model?
Ask separately about the lender’s own models and every outside model or platform used to operate the assistant. “We do not train on your data” may mean the provider does not use it for general model training while still retaining it for monitoring, fine-tuning, abuse detection, or human review.
Ask whether you can opt out before uploading, whether an opt-out applies retroactively, and whether it covers copies held by vendors. Confirm whether de-identified or aggregated information is exempt from the choice and how the provider decides that information is no longer reasonably linkable to you. Obtain the opt-out method and effective date in writing.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches4. Who can see or receive my mortgage information?
Request the names or categories of every recipient: underwriting, servicing, fraud, compliance, customer-support and information-security teams; affiliates; cloud-hosting companies; document-processing services; AI or model vendors; and other contractors. Ask where each recipient is located and whether data crosses national or state borders.
For every vendor, ask what the contract permits, whether the vendor may use information for its own purposes, whether subcontractors are allowed, and whether the lender audits access and deletion. Fannie Mae’s guide emphasizes limited disclosure and borrower authorization for NPI unless law permits disclosure; ask the lender to identify the specific authorization or legal exception it relies on.
5. What security and access controls protect the data?
Ask for a practical description of administrative, technical, and physical safeguards. Useful details include encryption in transit and at rest, identity and multifactor controls for staff, least-privilege access, separation of production and testing data, logging, vulnerability management, backup protection, employee training, and independent assessments.
Rank #3
- FAST DOCUMENT SCANNING — Document scanner with feeder allows you to speed through stacks with a 50-sheet Auto Document Feeder (ADF); Efficient office scanner to help you scan more productively
- INTUITIVE, HIGH-SPEED SOFTWARE — Quickly scan with this desktop document scanner; Epson ScanSmart Software lets you easily preview scans, email files, upload to the cloud, and more; Plus, automatic file naming saves even more time
- SEAMLESS INTEGRATION — Easily incorporate your data into most document management software with the included TWAIN driver; Office document scanner integrates seamlessly with business workflows
- EASY SHARING — Duplex scanner allows you to scan straight to email or popular cloud storage2 services like Dropbox, Evernote, Google Drive, and OneDrive for simple storage and sharing
- SIMPLE FILE MANAGEMENT — Scanner allows the creation of searchable PDFs with Optical Character Recognition (OCR) and convert scans to editable Word or Excel files effortlessly; Designed for home and office document scanning
Then ask who is authorized to open a transcript or document, whether access is granted temporarily, how it is reviewed, and whether every access is logged. A statement that the system is “secure” is not an answer unless the provider explains controls, oversight, and the process for revoking access when a worker or vendor no longer needs it.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute6. How long are prompts, uploads, and derived records kept?
Get separate retention periods for live chat content, uploaded files, application records, support tickets, audit logs, model-training copies, backups, and information held by vendors. Ask what event starts the clock: the end of a session, a withdrawn application, loan closing, payoff, or the end of a legal hold.
Ask whether the assistant stores a permanent account history by default and whether you can use it without creating one. If a retention period is described as “as long as necessary,” ask what criteria and maximum period apply.
7. Can I delete my data, and what survives deletion?
Ask for the exact deletion process, identity-verification steps, expected completion time, and a contact channel. Confirm whether deletion removes prompts, attachments, extracted fields, summaries, search indexes, analytics records, and vendor copies, or merely hides them from your account.
Ask how backups and disaster-recovery copies are handled, when they expire, and whether legal, fraud-prevention, accounting, or loan-servicing duties require retention. Request confirmation when deletion is complete and ask what happens to information already incorporated into a model or a human decision record.
Rank #4
- Scanner type: Document
- Connectivity technology: USB
- With Auto Scan Mode, the scanner automatically detects what you're scanning
- Digitize documents and images
8. What happens if there is a security incident?
Ask how the provider detects, investigates, contains, and documents incidents; which party leads the response; and who contacts you, when, and by what channels. Ask whether the lender will explain what information was involved, what protective steps are available, and how to verify that an alert is genuine.
Do not treat a contractual reporting deadline as a universal borrower-notification deadline. Fannie Mae’s current Information Security and Business Resiliency Supplement says covered business partners must report a cybersecurity incident to Fannie Mae within 36 hours after identification. The page lists implementation dates of August 12, 2025, for single-family sellers and servicers and multifamily lenders; December 31, 2025, for technology service providers; and April 1, 2026, for document custodians. Those are partner-reporting requirements, not a promise that a borrower will be notified within 36 hours. Ask the lender for its borrower-notification standard and applicable legal deadlines.
9. Does the assistant influence a mortgage decision?
Ask whether the tool is purely informational or whether its output is used in eligibility, pricing, underwriting, fraud review, servicing, loss mitigation, or another material decision. Ask which human reviews the output, how you can correct inaccurate input, and how you can request reconsideration.
If a creditor takes adverse action, Consumer Financial Protection Bureau guidance says complex models still require specific and accurate reasons. Generic sample reasons are inadequate when they do not reflect the actual reason for the decision. Ask for the concrete factors that affected your outcome and whether an AI-generated summary or score was one of them. A chatbot’s answer to a general question is not automatically a credit decision.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to record and compare two providers
Use the same worksheet for each assistant and save the date and version of every notice. Compare answers on the following axes:
Best Value
- OUR MOST ADVANCED SCANSNAP. Large touchscreen, fast 45ppm double-sided scanning, 100-sheet document feeder, Wi-Fi and USB connectivity, automatic optimizations, and support for cloud services. Upgraded replacement for the discontinued iX1600
- CUSTOMIZABLE. SHARABLE. Select personalized profiles from the touchscreen. Send to PC, Mac, mobile devices, and clouds. QUICK MENU lets you quickly scan-drag-drop to your favorite computer apps
- STABLE WIRELESS OR USB CONNECTION. Built-in Wi-Fi 6 for the fastest and most secure scanning. Connect to smart devices or cloud services without a computer. USB-C connection also available
- PHOTO AND DOCUMENT ORGANIZATION MADE EFFORTLESS. Easily manage, edit, and use scanned data from documents, receipts, photos, and business cards. Automatically optimize, name, and sort files
- AVOIDS PAPER JAMS AND DAMAGE. Features a brake roller system to feed paper smoothly, a multi-feed sensor that detects pages stuck together, and skew detection to prevent paper damage and data loss
| Comparison axis | What to record |
|---|---|
| Data collected | Prompts, transcripts, files, account data, external sources, and derived records |
| Purposes and training | Primary and secondary uses, model-training use, opt-out scope, and effective date |
| Recipients | Lender teams, affiliates, cloud and AI vendors, locations, subcontractors, and contract limits |
| Safeguards and access | Encryption, authentication, logging, staff authorization, reviews, and testing |
| Retention and deletion | Period by data type, deletion route, backup treatment, legal holds, and vendor deletion |
| Incidents | Detection, investigation lead, borrower contact, content of notice, and timing standard |
| Decision role | Whether outputs affect credit or servicing, human review, correction process, and specific explanations |
| Documentation | Privacy notice, AI disclosure, vendor terms, consent language, and the date retrieved |
Save screenshots or downloadable copies of the answers. If a representative promises a control that the written notice does not mention, ask for the notice to be corrected or obtain a written clarification naming the product and version.
Red flags that require a pause
- The provider cannot list the categories of information collected or the vendors that receive it.
- “No training” is asserted without explaining retention, human review, fine-tuning, or vendor use.
- There is no retention schedule, deletion route, or explanation of backups and legal holds.
- Access is described as unrestricted, shared, or unlogged.
- The assistant requests a full document when a specific field would answer the question, with no way to decline.
- The provider will not say whether outputs influence underwriting, pricing, fraud review, or servicing.
- Adverse-action explanations are generic and the lender cannot identify the actual factors used.
- The conversation answer conflicts with the current privacy notice and no one will resolve the conflict in writing.
Until the conflict is resolved, do not upload optional documents. Ask whether you can obtain the same help through a human loan officer or a secure portal with narrower disclosure.
What to do if you already uploaded sensitive documents
- Stop adding information and record the assistant name, account, date, files, and conversation identifiers.
- Download the current privacy, AI, and vendor notices and note the retention and training language in effect when you uploaded.
- Ask the lender’s privacy or security contact for a data inventory, recipients, retention schedule, training status, and deletion procedure.
- Submit a deletion or access request where available, while asking which records must remain for loan servicing, fraud prevention, legal, or regulatory reasons.
- Ask whether any incident has affected your information and how you will be contacted. Use a phone number from the lender’s official statement rather than a link in an unexpected message.
- For a disputed credit outcome, request human review and the specific adverse-action reasons; provide corrected documents through the lender’s secure channel.
Why asking for a privacy impact explanation is reasonable
The Consumer Financial Protection Bureau describes a privacy impact assessment as “an analysis of how personally identifiable information (PII) is handled” to check legal compliance, identify privacy risks, and find mitigations. You do not need the provider to disclose its entire internal assessment, but asking what risks were identified, what controls address them, and who approved the deployment is a useful test of governance.
Recommended Free Tools
Fannie Mae states that “cyber risk is a business risk and protecting data is a shared responsibility.” That principle gives borrowers a practical standard: the lender should be able to explain its own accountability even when an outside company operates part of the assistant. Ask which party owns each obligation and what you can do when the assistant, vendor, or lender gives conflicting answers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
