Protect borrower data by knowing where it goes, limiting who and what can access it, securing every transfer and storage point, and overseeing the vendors that handle it. For covered financial institutions under Federal Trade Commission (FTC) jurisdiction, the FTC Safeguards Rule requires a written, risk-based information security program. Regulation P addresses privacy notices and information sharing; securing data and controlling its disclosure are related but separate duties. Which rules apply depends on an organization’s activities and regulator, so this federal baseline is not an institution-specific legal determination.
Start with the data, not the platform
A mortgage file does not live in one loan origination system (LOS). It may begin in an online application, move through a broker or lender portal, pass to credit-reporting or e-signature services, appear in email or staff downloads, and remain in backups or a service provider’s environment. The FTC says an institution needs to know what information it holds and where it is stored before assessing foreseeable risks. Records kept on the institution’s behalf count too: a copy in a vendor’s system does not fall outside the security program simply because the institution does not operate that system. See the FTC’s Safeguards Rule guide.
As an Amazon Associate I earn from qualifying purchases.
Build a borrower-data inventory
List the information the organization collects, creates, receives, uses, shares, stores, and disposes of. A useful inventory records the data type, business purpose, system or location, people and providers with access, transfer route, retention practice, and responsible owner. Include, where applicable:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Application details such as names, addresses, income, Social Security numbers, and account information.
- Identity, income, asset, and other supporting documents submitted by the borrower or obtained during underwriting.
- Consumer-report information, loan transaction details, payment history, and balances.
- Copies in email, file-exchange services, e-signature tools, lender or broker portals, LOS integrations, backups, and staff devices.
- Information held by cloud-storage, software, and other service providers on the institution’s behalf.
Trace a sample file through the full lifecycle—from intake to use, sharing, archiving, and deletion—to uncover duplicate copies and transfers that a system list alone can miss. Do not assume a file is deleted because it disappears from the borrower-facing portal; confirm how the platform, connected services, and backups handle it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Also distinguish what the data is from where it sits. Nonpublic personal information can include personally identifiable financial information collected in connection with a financial product or service, such as application details, transaction information, and consumer-report information. That means an inventory should not focus only on documents labeled “sensitive.” Record information created or received during the relationship too, and identify why each system or recipient needs it.
Put a written, risk-based security program in place
For institutions covered by the FTC Safeguards Rule, security is an ongoing program, not a one-time technology purchase. The Rule calls for safeguards suited to the organization’s size and complexity, the nature and scope of its activities, and the sensitivity of customer information. The FTC guide describes core activities that include assessing risks, choosing and implementing safeguards, monitoring their effectiveness, training staff, overseeing service providers, and maintaining an incident response plan. Assign responsibility to a qualified individual and make sure that person has the authority and resources to coordinate the work.
Turn the inventory into a risk assessment: identify likely internal and external threats to confidentiality, integrity, and availability, then assess which borrower-data locations and operations are exposed. Revisit the assessment when a system, network, operation, or business arrangement changes; a new integration or provider can change the risk even if the borrower-facing workflow looks the same.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteKeep a record of decisions and changes: what risk was identified, which safeguard addresses it, who owns the action, and whether follow-up is needed. The point is not to produce paperwork for its own sake; a documented program makes it possible to spot gaps between the written policy and the way staff and systems actually handle borrower information.
Limit access and protect user accounts
Use least privilege and review access
Give employees and contractors access only to the borrower information and functions they need for current work. Separate routine work from administrative privileges where the system allows it. Set a process for promptly changing or removing permissions when someone changes role or leaves, and periodically review who can access customer information, including vendor accounts and integration credentials. A review should check whether each account still has a business purpose, not merely whether it is active.
Require multifactor authentication
The FTC defines multifactor authentication (MFA) as using at least two different factor types: something known, such as a password; something possessed, such as a token; or something inherent, such as a biometric. Use MFA for people accessing customer information, and configure it through the organization’s identity system and supported applications. A hardware security key may serve as one possession factor when the identity platform supports it and the security team approves its use; buying a key alone neither establishes MFA nor demonstrates compliance.
When evaluating MFA, check whether it is available for the applications and accounts that matter, including administrative access and vendor or remote access. Factor support depends on the organization’s identity platform and how applications are configured, so confirm the complete sign-in path rather than assuming a particular device or login feature covers every system.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Log and monitor activity
Enable logging for authorized-user activity and monitor for signs of unauthorized access. Decide who reviews alerts, what events require escalation, and how findings are documented. Logs are useful only if the organization can access them, retain them appropriately, and investigate them across connected systems. Confirm which activity records a platform or provider makes available before relying on them.
Secure files, applications, and connections
Encrypt borrower information at rest and in transit. Check what the term means for each system: where encryption applies, how transfers are protected, and who controls access to encryption keys. The FTC guide says that when encryption is not feasible, effective alternative controls require approval by the qualified individual. Do not treat a vendor’s general statement that it “uses encryption” as a substitute for understanding the data flows and safeguards relevant to the institution.
Evaluate the security of internally developed and third-party applications that store, access, or transmit customer information. Review the whole path, not only the primary LOS: application forms, document uploads, portals, e-signatures, APIs, data exports, backups, and staff access can create separate exposure points. For integrations, identify what data is sent, why it is needed, how access is authenticated, and whether the receiving party retains a copy.
Use an approval process for new systems and material changes. Before enabling a feature or connection, confirm that its business purpose is defined, the data involved is understood, access is appropriately limited, and the security assessment has considered the altered environment. Reassess when networks, operations, or business arrangements change, as the FTC guide recommends.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteEvaluate and oversee technology vendors
Vendors are part of the borrower-data environment. The institution remains responsible for overseeing service providers that handle customer information; outsourcing a function does not outsource that oversight. Select providers with the ability to maintain appropriate safeguards, set security expectations in contracts, monitor their work, and periodically reassess them. The FTC’s Safeguards Rule guide explains these provider-oversight duties.
Use a consistent review before onboarding and at reassessment. Ask for evidence that addresses the actual service and data involved, and record the decision and any conditions for approval.
| Review area | What to establish |
|---|---|
| Data and access | What borrower information the service receives, where it is stored, who can access it, and how the provider limits access. |
| Encryption and authentication | How information is protected at rest and in transit, how user and system access is authenticated, and whether the controls fit the institution’s requirements. |
| Applications and integrations | How the provider assesses its application and connected services, what data an integration exchanges, and how credentials and permissions are controlled. |
| Logs and monitoring | What activity records and security notifications the provider makes available, and how the institution can review or act on them. |
| Incident cooperation | How the provider will promptly notify and cooperate with the institution about a security incident, preserve relevant information, and support investigation and response. Align contract language and procedures with applicable legal deadlines. |
| Contract rights and evidence | Whether written terms state security expectations and provide a practical basis for monitoring, reassessment, and obtaining relevant evidence. |
| Retention, export, and deletion | How the institution can retrieve its data, what happens to copies at termination, and how deletion and backup handling are addressed. |
| Fit and reassessment | Whether controls fit the institution’s regulatory and operational needs, and when changes in service, risk, or business arrangement trigger another review. |
These are comparison criteria, not a ranking of mortgage platforms. Compare each system and service provider against the same data and control needs: access, encryption and MFA support, application and integration review, logging, response cooperation, contract and audit evidence, retention, export, and deletion. No current official ranking establishes that one platform is best; the suitable choice depends on how its controls fit the organization’s actual workflow and obligations.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not treat a contract, questionnaire, or vendor assurance as proof that all risks are resolved. Match the evidence to the service, document unresolved issues, and decide whether they require remediation, additional safeguards, limits on use, or rejection of the service. Reassess providers periodically and when material changes warrant it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Set retention and secure-disposal rules
Define how long borrower records are needed, who approves exceptions, and how each system and provider handles disposal. The FTC’s December 2024 Safeguards Rule guide describes disposal no later than two years after the most recent use of customer information to serve the customer, subject to exceptions for a legitimate business need, legal retention requirements, or infeasibility of targeted disposal. This is not an instruction to delete records without checking other obligations: coordinate deletion with applicable mortgage, litigation, contract, and record-retention duties. When information is no longer required, use secure disposal procedures that address both institution-controlled records and provider-held copies.
For each provider, establish what can be exported, how data is returned when service ends, and how remaining copies are deleted or handled under applicable retention requirements. Check backups and connected services rather than relying only on a user-facing delete button. A retention schedule should make room for required exceptions while avoiding indefinite retention by default.
Train staff and prepare for incidents
Make training match the work
Train employees on the organization’s security practices and their responsibilities for borrower information. Give specialized training to people responsible for the information security program. Role-based instruction should reflect the systems people use and the actions they are expected to take, such as handling documents, protecting account access, and escalating suspected exposure. Maintain a written record of the program, responsibilities, training, assessments, and corrective actions so the organization can track whether safeguards are operating as intended.
Write and exercise an incident response plan
The plan should identify roles and decision-makers; internal and external communications; steps to contain, remediate, and recover from an event; how incidents and decisions will be documented; applicable reporting procedures; and a post-incident review. Include vendor contacts and escalation routes, and know how to preserve relevant information from systems the institution does not operate. A suspected incident should be escalated through the plan promptly rather than waiting for a complete technical explanation.
Recommended Free Tools
The FTC Safeguards Rule includes a specific notification requirement for covered institutions: report a qualifying notification event to the FTC as soon as possible and no later than 30 days after discovery. The requirement took effect in May 2024. The defined event involves unauthorized acquisition of unencrypted customer information concerning at least 500 consumers. Encrypted information can count as unencrypted for this threshold if an unauthorized person accessed the encryption key. The threshold and deadline are specific to this FTC requirement; other notification duties may apply, and an organization should not assume that an event below this threshold has no reporting or response obligations. See the FTC’s October 2023 announcement and its Safeguards Rule guide for details.
The FTC described transparency as a key reason for the reporting amendment. Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, said: “Companies that are trusted with sensitive financial information need to be transparent if that information has been compromised.” The quote reinforces why escalation and vendor cooperation matter: a lender may need timely facts from a provider to assess the event and determine which response and reporting duties apply.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The Rule also calls for the qualified individual to provide a written report regularly, at least annually, to the board or equivalent governing body—or to the responsible senior officer if there is no board. The report should support meaningful oversight of the program rather than merely confirm that a document exists.
Keep privacy obligations distinct from security controls
Security safeguards protect information against risks such as unauthorized access; privacy requirements govern how information is described and shared. Under Regulation P, privacy notices and restrictions on disclosure to nonaffiliated third parties, reuse, and redisclosure are relevant to mortgage workflows. A secure transfer does not by itself establish that a disclosure is permitted or accurately described in a notice.
Free tools Windows power users keep installed
One-click scans. No signup required.
The FTC’s GLBA privacy guidance describes nonpublic personal information as personally identifiable financial information collected in connection with a financial product or service, unless it is lawfully publicly available under the rule. Examples include information provided on a loan application, transaction information such as payment history or balances, and consumer-report information obtained in connection with the service. The CFPB’s Regulation P resource summarizes the regulation; the FTC explains compliance with the privacy rule in its GLBA privacy guidance.
Before enabling a data-sharing feature or sending information to a technology provider or another third party, identify the purpose, information disclosed, recipient, and applicable notice and sharing conditions. Ensure notices accurately describe actual practices, and review the effect of changes to integrations or vendor use on those practices. Confirm the organization’s specific privacy duties with its compliance or legal advisers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Confirm which rules apply to the organization
The FTC identifies mortgage lenders and mortgage brokers as examples of financial institutions under the Safeguards Rule, but FTC enforcement applies to institutions within FTC jurisdiction that are not subject to another regulator’s enforcement authority. The nature of the business activities matters more than the label a company uses for itself. Regulation P’s summary also lists non-bank mortgage lenders, mortgage brokers, businesses that extend credit or service loans, and settlement service providers as entities that may be covered.
Do not infer coverage solely from being in the mortgage industry. Confirm the organization’s activities, regulator, and applicable requirements. This article covers a U.S. federal baseline; state privacy and breach-notification laws, mortgage licensing requirements, contracts, and record-retention rules may add duties. The FTC Safeguards Rule guide and the CFPB’s Regulation P resource provide starting points, not a state-by-state or institution-specific legal determination.
A practical control checklist for selecting or using a platform
- Map the workflow. Inventory the borrower data, collection points, systems, transfers, copies, users, providers, backups, and disposal routes.
- Assess risk and ownership. Identify foreseeable threats, assign an accountable owner, and reassess when systems, networks, operations, or business arrangements change.
- Check access and identity controls. Verify least-privilege permissions, periodic access reviews, prompt role-change removals, MFA, and usable activity logs.
- Review protection across the data path. Confirm encryption at rest and in transit, application and integration security review, and controls for exports, devices, and connected services.
- Approve providers deliberately. Evaluate safeguards and service fit, document findings and gaps, set contract expectations, establish monitoring, and schedule reassessment.
- Align privacy, retention, and disposal. Check disclosures against actual practices and notices; coordinate retention periods with legal duties and secure disposal across provider-held copies.
- Prepare people and response. Train staff, maintain a written response and recovery plan, define escalation and reporting procedures, and provide the required written program report to governance at least annually.
There is no single mortgage-platform feature that replaces this program. The useful selection question is whether the system and its provider can fit into the institution’s mapped data flows, safeguards, privacy practices, oversight process, and response plan.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Frequently Asked Questions
What does the FTC Safeguards Rule require companies to do?
For covered financial institutions under FTC jurisdiction, it requires a written, risk-based information security program. FTC guidance describes risk assessment, appropriate safeguards, monitoring, staff training, service-provider oversight, secure disposal, and a written incident response plan. A qualified individual oversees the program and reports in writing at least annually to the board or equivalent governing body, or the responsible senior officer when there is no board.
Who is covered by the FTC Safeguards Rule?
The FTC names mortgage lenders and mortgage brokers as examples, but coverage depends on the organization’s activities and regulator. The rule applies to financial institutions within FTC jurisdiction that are not subject to another regulator’s enforcement authority. Confirm the specific organization’s coverage rather than relying on its business label.
What are the Safeguards Rule breach notification requirements?
A covered institution must report a qualifying notification event to the FTC as soon as possible and no later than 30 days after discovery. The defined event concerns unauthorized acquisition of unencrypted customer information involving at least 500 consumers. Unauthorized access to encryption keys can cause encrypted information to count as unencrypted for this threshold. Other notification duties may apply.
Does the Safeguards Rule cover borrower records stored by a mortgage technology vendor?
Records maintained on an institution’s behalf remain within the security program’s scope. A vendor-held copy does not cease to matter because the institution does not operate the system; the institution should assess and oversee providers that handle the information.
How long can a lender retain borrower information under the FTC disposal guidance?
The FTC’s December 2024 guide describes disposal no later than two years after the most recent use to serve the customer, subject to legitimate business needs, legal retention requirements, and infeasibility exceptions. Coordinate disposal with applicable records-retention obligations before deleting data.
Is encryption enough to protect borrower privacy?
No. Encryption is a security safeguard, but Regulation P also addresses privacy notices and restrictions on disclosure to nonaffiliated third parties, reuse, and redisclosure. A secure transfer alone does not show that sharing is permitted or accurately described in a notice.
The Bottom Line
Protecting borrower data is an ongoing program: map every place information travels, apply access and security controls across systems and vendors, review sharing and retention, and prepare staff to respond. Confirm which federal, state, and regulator-specific duties apply to your organization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
