Security
Security a bank can review.
SOC 2 Type 1 report. Data encrypted in transit and at rest. Role-based access with 2FA.
The report and our security policies are shared under NDA. Your questionnaire is answered line by line.
- SOC 2 Type 1 report from an independent auditor
- Encrypted in transit and at rest
- Role-based access with 2FA
- Borrower or loan officerThe borrower uses a secure link or QR code. The loan officer uploads in the portal. Not email.
- In transitEncrypted between the browser and Rapidio.
- At restEncrypted storage. Access by role.
- Rapidio reads and calculatesDocuments split and labeled, income to the guideline, conditions.
- A flagged loan onlyThe assigned internal underwriter, under NDA.
- Your teamThe users you allow, by role, with 2FA.
Four facts
- SOC 2 Type 1 report
- Encrypted in transit and at rest
- Role-based access with 2FA
- Borrower documents seen only by the assigned internal underwriter, under NDA
The same four facts, in the same words, on every page of this site and in every answer to your questionnaire.
Access
Who can see a borrower's documents.
The question every reviewer asks first. The answer fits in four lines.
| Who | Sees the documents | How |
|---|---|---|
| Your team | Yes | The users you allow, by role. Two-factor authentication at sign-in. Each loan can be assigned to one person. |
| The system | Reads them | Encrypted in transit and at rest. It splits and labels the documents and calculates the income. |
| One person at Rapidio | Only when a loan is flagged | The assigned internal underwriter, under NDA. Not an anonymous back office. |
| Anyone else at Rapidio | No | Sales, support and engineering do not see borrower documents. |
Data handling
What happens to a document, step by step.
From the borrower's phone or the loan officer's desk to your records. Nothing travels by email.
-
Step 1 · Upload
Two ways in: the borrower's link, or the loan officer's portal
You send the borrower a secure upload link or QR code from the loan, or the loan officer uploads the documents in the portal. Either way they go straight into that loan, encrypted in transit.
-
Step 2 · Storage
Stored encrypted, opened by role
Data is encrypted at rest. Who can open a loan follows the roles you set, and every sign-in uses two-factor authentication.
-
Step 3 · Calculation
Rapidio reads the documents and calculates the income
Documents are split and labeled by type. The income is calculated to the guideline you chose, with the worksheet and the page and line behind every figure. Smart Conditions list what the loan still needs.
-
Step 4 · Human review, only when flagged
One assigned underwriter, under NDA
When a loan needs a human eye, the assigned internal underwriter looks at it. The loan records who created it, who selected a calculation option, and when.
-
Step 5 · Your records
Export, retention and deletion
Export the loan report and the documents as PDF or DOCX for your own records. Retention and deletion can be set for your account on request.
In the product
Controls your team holds.
Roles, assignments and a record of who did what, inside every loan.
- Assign each loan to a person and control who can open it
- The loan records who created it, who selected a calculation option, and when
- A secure upload link or QR code for the borrower, or upload in the portal yourself. Documents do not travel by email
- Export the loan report and the documents for your own records
SOC 2 Type 1
What the report tells you.
For the reviewer who has read a hundred of them, and for the one reading the first.
Independent
A licensed CPA firm examined Rapidio's controls and issued the report. It is their opinion, not ours.
Type 1: the design of controls, as of a date
A Type 1 report says whether the controls are suitably designed at a point in time. A Type 2 report tests them over a period. Ask us about Type 2 on the call.
The Security criteria
Every SOC 2 report covers the AICPA Security criteria: logical access, change management, system operations, risk assessment and incident response.
The report is shared under NDA. Ask for it before your review, so your reviewer reads it first and asks us second.
For your vendor review
What we send, and how the review runs.
Everything below comes before a contract, not after it.
-
Ask for the documents
Write to service@rapidio.com. The report and the policies come under NDA.
-
Send your questionnaire
We answer it line by line and walk through it with your reviewer on a call.
-
Run a free pilot week
Your team runs its own loans and compares the worksheets. Then the account setup, the contract and the rollout.
More about the product
FAQ
Questions a security reviewer asks.
Have another question? Write to service@rapidio.com or book a 30-minute call.
Does Rapidio have a SOC 2 report?
Yes, a SOC 2 Type 1 report from an independent auditor. Ask us for it, and we send it under NDA for your vendor review.
Type 1 or Type 2?
Type 1 today: an auditor's opinion on the design of the controls as of a date. Ask us about Type 2 on the call.
Who at Rapidio can see borrower documents?
Only the assigned internal underwriter, under NDA, when a loan needs a human eye. No one else at Rapidio sees the documents.
Is the data encrypted?
Yes. Data is encrypted in transit and at rest.
How do users sign in?
With two-factor authentication. Access is role-based, so each user sees what their role allows, and you can assign each loan to a person.
How do the documents get in?
Two ways. The borrower uploads through a secure link or QR code that you send from the loan, or the loan officer uploads the documents in the portal. Either way they go straight into the loan. Nothing travels by email.
Can you set retention and deletion for our account?
Yes, on request. Tell us the retention period your policy requires, and when loans and documents should be deleted.
Does Rapidio make the lending decision?
No. Rapidio calculates the income and prepares the worksheet. Your team reviews it, applies its own requirements and makes the lending decision.
Where do we send our questionnaire?
To service@rapidio.com. We answer it line by line and walk through it with your reviewer on a call.
Can we review Rapidio before we commit?
Yes. Ask for the documents, send your questionnaire, and run a free pilot week on your own loans. Rollout, pricing and integration are decided after the pilot.
Send us your questionnaire. We answer it line by line.
Ask for the SOC 2 Type 1 report and our security policies, or book 30 minutes with us and bring your reviewer.