Security & compliance

Written for the person doing the vendor review.

Uplist processes closed-loan portfolio data for regulated lenders. This page states what is in place today, what our agreements commit us to, and where we are in the process — without the vagueness these pages usually contain.

Start here

The smallest possible surface area

Most of a vendor review is establishing what a system can reach. Uplist deliberately reaches very little.

Uplist does not pull credit
No hard pull, no soft pull, no consumer report. Uplist is not a consumer reporting agency and performs no credit inquiries of any kind.
Uplist does not originate or make credit decisions
A technology provider to licensed lenders. Uplist holds no NMLS. All lending decisions and disclosures remain with the institution.
Uplist does not sit inside or write to your LOS
No integration into the loan origination system, no write access, no presence in the loan file. Uplist is a monitoring and presentation layer.
Consumer-facing tools collect nothing
A prospective buyer viewing payment information provides no name, no contact details, and no Social Security number, and triggers no credit inquiry.
Borrower communications carry your identity, not ours
Notices go out under the lender’s brand, in the originator’s name, with that originator’s NMLS. Uplist does not communicate with borrowers on its own behalf.
Controls in place

Operating today

Only controls currently in operation are listed here. Items still being formalized appear further down rather than being described as complete.

Encryption at rest and in transit
Customer Information is encrypted both in transit over external networks and at rest, meeting the definition set out in 16 CFR 314.2(f).
Multi-factor authentication
MFA is required for any individual accessing an information system, meeting the definition set out in 16 CFR 314.2(k).
Least-privilege access controls

Authenticated access is limited to authorised users, and those users are limited to the information required to perform their function.

Written incident response plan
A documented plan covering internal response processes, defined roles and decision authority, internal and external communication, remediation, and post-event review.
Independent audit

SOC 2 Type II

Uplist is currently undergoing a SOC 2 Type II audit. It is not yet complete, and we do not hold a SOC 2 report at this time.

If a completed SOC 2 report is a prerequisite for your review, tell us early and we will share where we are in the process and the expected timeline.

Contractual commitments

What our enterprise agreement obligates us to

These are terms in the data protection exhibit to our enterprise subscription agreement — binding obligations rather than statements of intent. Your counsel will read the executed version; this is what it contains.

Service provider role

Uplist processes Customer Information solely to fulfil its obligations under the agreement, and does not disclose it to third parties except at the client’s specific written direction.

Applicable law

Compliance warranties covering the Gramm-Leach-Bliley Act, the FTC Safeguards Rule at 16 CFR Part 314, and the CCPA where applicable.

Breach notification

Immediate notification to the client of any actual or suspected breach of the confidentiality of Customer Information.

Client right to assess

Clients may conduct periodic assessments on reasonable notice, including review of certifications, reports, and third-party audits, and are afforded access to facilities, systems, procedures, and personnel.

Sub-processor flow-down

Sub-processors are bound by the same data protection obligations, and Uplist remains responsible for their handling of Customer Information.

Retention and disposal

Data retained only as long as necessary to provide the Services or as required by law, then returned or securely destroyed on termination or client request.

CCPA positioning

Uplist is the Service Provider and the client is the Business. Sharing between them is not a sale of Personal Information.

Indemnification

Uplist indemnifies, defends, and holds the client harmless against loss arising from a breach of its privacy and data security obligations.

Vendor review

Send us your questionnaire

Tell us you’re doing a security or vendor review and we’ll route you straight to documentation rather than through a sales sequence.

Uplist is a technology provider. Uplist is not a lender or mortgage broker, does not originate loans, and does not make credit decisions. Any payment or rate figures shown through Uplist products are estimates provided by the originating lender, are subject to change, and are not a commitment to lend or a guarantee of approval or of rate availability. Pricing shown on this page is subject to change. Equal Housing Opportunity.