DATA GOVERNANCE & COMPLIANCE

Your data stays yours.

Ring-fenced data architecture. Role-based access controls. Full audit trail. Built for institutional compliance requirements from day one.

Role-Based Data Isolation

The platform serves three distinct roles — Lenders, Investment, and Solicitors. Each operates within a fully ring-fenced environment with dedicated database tables, separate API modules, and JWT-enforced access controls. A lender's loan book, borrower data, and payment records are never accessible to any other role. This separation is enforced at the API layer — not the frontend — meaning it cannot be bypassed.

Lender Data Protection

Data CategoryLenderInvestmentSolicitor
Lender data (loan book, payment records, borrower information)
Cross-lender payment signals
Investment data (targets, deals, bids)
Solicitor data (matters, searches)

Investment Data Sources — Public Only

Investment users on the platform analyse acquisition targets using exclusively public and self-sourced data: Companies House (public record), Experian (licensed commercial data available to any subscriber), HM Land Registry (public), Insolvency Service records (public), and agent marketing materials provided directly through the transaction process. No lender-contributed data — including borrower information, loan book data, or payment behaviour — is accessible to investment accounts.

Cross-Lender Intelligence — Lender Exclusive

The cross-lender payment alert system is a lender-only feature. When a borrower entity appears across multiple lender accounts and shows late payments at one institution, anonymised alerts are generated for other lenders with exposure. No lender identity is disclosed — the alert indicates a payment delay has been detected, not which lender reported it. This feature is exclusively available to lender accounts. Investment and solicitor accounts have no access to cross-lender data at any level.

Access Controls & Audit Trail

Every account is assigned an immutable role at registration, encoded in signed JWT tokens and verified on every API request. Every database query is scoped to the authenticated user's account — there is no “view all” capability. All operations are logged in dedicated per-role activity log tables with user ID, action type, entity references, and timestamps.

Data Protection Compliance

UK GDPR and Data Protection Act 2018 compliance. Lawful basis: legitimate interest (B2B commercial data) and contract performance. Data minimisation: each role accesses only the data necessary for its function. Purpose limitation: lender data is never repurposed for other roles. Companies House data is Crown Copyright under the Open Government Licence. Experian data is licensed B2B data, independent of any lender relationship.

Summary of Controls

Role assignmentImmutable account_type in JWT
API enforcementDedicated module per role with role guard
Database isolationSeparate tables per role
Row-level securityEvery query scoped to user ID
Cross-lender dataLender-only; other roles have zero access
Lender loan bookNever exposed to non-lender roles
Audit trailPer-role activity logs

Built for compliance. Ready for review.

Request a full technical walkthrough with your compliance team.