Security
How Aloan protects your loan data
Aloan holds a SOC 2 Type II report, encrypts every file at rest and in transit, keeps all customer data in the United States, and never uses it to train an AI model.
Reviewed October 2026
Independent assurance
Controls an outside auditor has tested.
SOC 2 Type II
Aloan holds a completed SOC 2 Type II report from Prescient Assurance on the Security trust services criteria, for the observation period December 22, 2025 to March 22, 2026. A Type II report tests how controls operated across that window, not on a single day. We renew the examination every year, and our CTO signs a bridge letter for your institution covering the time since.
What to check inside any vendor's report: the SOC 2 Type II guide for commercial lending AI.
Penetration testing
An independent firm tests the platform at least once a year. The January 2026 test (Oneleet, an OSCP and OSCE certified tester, OWASP WSTG v4) included direct prompt-injection testing of the AI features and of the separation between institutions. The report is available under NDA.
Data protection
How Aloan handles your loan data.
Encrypted at rest and in transit
AES-256 at rest for all customer data, including the database, document storage and backups. TLS 1.3 on connections to the platform, and TLS 1.2 or higher between services.
Kept in the United States
All storage, processing and backup of customer data happens in the United States, and no subprocessor stores it anywhere else. We commit to US-only handling in the agreement.
Separate from every other institution
Every record is scoped to your institution and checked on every request, and an AI prompt carries only your institution's data. Nothing from your files shapes another institution's results. Our January 2026 penetration test tested this boundary directly.
Limited, logged access
Aloan staff reach customer data only through least-privilege, role-based access with MFA. Administrative actions are logged, access is reviewed quarterly, and it is revoked within one business day of someone leaving. Your users sign in with MFA, or through your identity provider with SAML or OIDC single sign-on, including Microsoft Entra ID.
48-hour incident notice
Our standard agreement commits us to written notice within 48 hours of discovering a security incident, with its nature and scope, a single point of contact and regular updates.
Kept, returned and deleted on your terms
Your data is kept for the term of the agreement, or a shorter period you set in it, and deletion requests are completed within 30 days. At termination you choose return or destruction, completed within 60 days and certified in writing. Aloan does not sell or share your data, or use it for anything but delivering the service to you. See the privacy policy.
AI and your data
Your loan files never train a model.
Aloan runs its AI through enterprise services from Google (Gemini) and AWS (Bedrock), both processing in the United States. Their terms prohibit using your inputs or outputs to train, fine-tune or improve a model, and Aloan trains none of its own: there is no proprietary model and no model built from any institution's data.
What a provider may keep, and for how long, is named in your agreement and confirmed in writing before any of your data is processed. We notify you in writing before a provider is added or removed, and before its retention or training terms change.
Aloan makes no credit decision. Every extracted figure links back to the pages it came from, every AI-drafted statement cites its source, and every override records who made it, when and why, so your team and your examiner can check the work.
Vendor due diligence
What your vendor-management team gets.
Most of these are in the Trust Center's documents tab. The bridge letter, the data flow diagram and the NIST AI RMF mapping come on request, and we complete your institution's own questionnaire.
SOC 2 Type II report
With a bridge letter for your institution, signed by our CTO.
Penetration test report
January 2026, independent, including the AI features.
Due diligence questionnaire
Our standing answers to the questions banks and credit unions ask most.
Information Security Program
The full set of 22 policies, each reviewed at least annually.
Business continuity and disaster recovery
The policy and its recovery objectives.
AI governance
The AI Governance and AI and LLM Data Isolation policies, with a NIST AI RMF mapping.
Subprocessor list
Every third party that receives customer data, what it processes and where.
Data flow diagram
Architecture, every AI call, storage, encryption and transport.
Regulatory frame
Evidence for the guidance your examiner applies.
Aloan is a vendor, not a regulated institution, so these obligations are yours. Here is what we provide for each.
Third-party risk management: OCC Bulletin 2023-17
The documents above cover due diligence and ongoing monitoring. The OCC 2023-17 guide for AI underwriting vendors walks the lifecycle.
GLBA Safeguards Rule and NCUA Part 748
No GLBA certification exists for a service provider. We support your obligations with the security program on this page, independent evidence from the SOC 2 report and penetration test, and contractual safeguards, confidentiality, audit and breach-notification terms.
Model risk management: SR 26-2 and OCC Bulletin 2026-13
These replaced SR 11-7 on April 17, 2026. They are risk-based and leave generative and agentic AI out of scope, so your own program decides how to classify Aloan. Source citations, override records and human approval of every credit decision give it something to test. See the examiner readiness guide.
FAQ
Security and compliance questions.
Does Aloan have a SOC 2 Type II report?
Yes. Aloan holds a completed SOC 2 Type II report from Prescient Assurance on the Security trust services criteria, for the observation period December 22, 2025 to March 22, 2026. It is available under NDA through our Trust Center at trust.aloan.ai, with a bridge letter signed by our CTO covering the period since. Aloan renews the examination annually.
How does Aloan encrypt and store loan data?
All customer data is encrypted at rest with AES-256, including the database, document storage and backups, and in transit with TLS 1.3 on connections to the platform and TLS 1.2 or higher between services. All storage, processing and backup of customer data happens in the United States.
Is our data used to train AI models?
No. Aloan does not train, fine-tune or improve any model on customer data, and its AI providers, Google (Gemini) and AWS (Bedrock), are contractually prohibited from doing so. No customer-specific model exists, and nothing from your files influences results for another institution.
What can Aloan provide for our third-party risk review?
The SOC 2 Type II report, the penetration test report, our due diligence questionnaire, the Information Security Program, the business continuity and disaster recovery policy, our AI policies and the subprocessor list are in the Trust Center at trust.aloan.ai. A bridge letter for your institution, the data flow diagram and a NIST AI RMF mapping come on request, and we complete your institution's own questionnaire.
Does Aloan undergo penetration testing?
Yes, by an independent firm at least once a year. The most recent test, in January 2026, included direct prompt-injection testing of the AI features and of the separation between institutions. The report is available under NDA.
How quickly will Aloan notify us of a security incident?
Our standard agreement commits Aloan to written notice within 48 hours of discovering a security incident, with the nature and scope of the incident, a single point of contact and regular status updates. An institution that needs a shorter window can negotiate it in its agreement.
How do I report a security vulnerability?
Email support@aloan.ai with the details. Please give us a reasonable window to investigate and fix the issue before you disclose it publicly.
Bring your security questions to a call.
Thirty minutes with our team to walk through your vendor-management requirements and the documents behind them.
Book a security review