Data Processing Overview
A high-level description of the separation between the platform operator and subscriber-controlled lending data.
Commercial launch note: A formal Data Processing Agreement should be finalized with counsel before onboarding customers that require contractual processor/controller terms.
Role separation
For subscriber-controlled borrower and lending records, the lending company generally determines why and how the data is used for its lending operations, while the platform supplies the software infrastructure used to process the records.
Tenant separation
LoanDesk Works is designed to keep subscriber records logically separated through tenant-aware authentication and data access. A subscriber does not receive access to another subscriber's borrower or loan records.
Authorized access
Subscribers control their own users and permissions within the limits of their subscription plan. Platform support access to subscriber data should be limited to legitimate support, security or operational needs and appropriately logged.
Subprocessors and hosting
The final production DPA should document hosting locations, email services, payment providers, backups and other subprocessors actually used by the commercial deployment.
Security and incident response
The production service should maintain documented security controls, backup procedures, access review, incident handling and notification processes appropriate to the nature of the stored information.