Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Before you upload a pay stub, tax return, bank statement or identity document to an AI mortgage assistant, ask the provider exactly what it collects, why it needs it, who can access it, how long it is retained, whether it is used for model training, and what happens after a security incident. Also establish whether the assistant merely provides information or can influence eligibility, pricing, underwriting or servicing.
Do not rely on a chatbot’s reassuring wording alone. Request the current privacy notice, AI disclosure and relevant vendor terms, then compare those documents with the answers you receive. If the provider cannot give a clear answer, do not submit sensitive documents until a human representative explains the gap.
Why mortgage-assistant data deserves special care
Information used in a mortgage application can be nonpublic personal information (NPI). Federal Trade Commission guidance describes NPI as including information supplied to obtain a financial product, data from a transaction and information obtained in connection with providing a financial service. That can encompass your name and contact details, income, assets, debts, account numbers, property information, identification documents, application status, conversation transcripts and documents uploaded to an assistant.
The Gramm-Leach-Bliley Act (GLBA) applies to covered financial institutions that offer loans. FTC guidance says those institutions must explain information-sharing practices and safeguard sensitive information. The FTC Safeguards Rule identifies mortgage lenders and mortgage brokers among examples of covered financial institutions and describes written security programs using administrative, technical and physical safeguards. Whether a particular lender, broker, technology company or service arrangement is covered—and which obligations apply—depends on the entity and circumstances.
#1 Best Overall
A technology vendor may process data for a lender without having the same direct legal duties as the lender. That is why your questions should address both the lender’s controls and the contractual restrictions placed on every AI or cloud provider that handles your information.
“A privacy impact assessment (PIA) is an analysis of how personally identifiable information (PII) is handled to (i) ensure that collection, use, and handling conforms with applicable requirements, (ii) determine the privacy risks associated with an information system or activity, and (iii) identify ways to mitigate privacy risks.” — Consumer Financial Protection Bureau, Privacy Impact Assessments.
Start with a precise inventory of what the assistant collects
Ask the provider to describe every input and every automatically generated record, not just the documents you intentionally upload.
Questions to ask
- What information is collected from my prompts, uploaded files, account profile, mortgage application and connected systems?
- Does the service capture complete conversation transcripts, message timestamps, device details, IP address, browser information, location data, clicks or usage analytics?
- Does it extract text, images, numbers or metadata from documents, and are those extracted fields stored separately from the original file?
- Does it obtain information from credit, property, employment, fraud-prevention or public-record sources? Which sources are used for my application?
- Are voice recordings, screenshots, cookies or session identifiers retained?
| Data category | Examples to clarify | Record the provider’s answer |
|---|---|---|
| Prompts and replies | Questions, assistant responses, timestamps, conversation ID | Collection and transcript retention period |
| Uploaded documents | Pay stubs, tax forms, bank statements, identification, purchase contracts | Original-file storage, extraction and deletion process |
| Application data | Income, debts, assets, property address, loan amount, occupancy | Systems receiving the fields and permitted uses |
| Technical and usage data | IP address, device, browser, logs, error reports, feature use | Purpose, access and retention |
| Derived information | Risk flags, classifications, summaries, confidence scores | Whether it affects a decision and how it can be corrected |
Ask whether optional conversation history can be disabled and whether the assistant works without submitting a full application. Data minimization matters: if a question can be answered without a document, do not upload the document merely for convenience.
Rank #2
Clarify every purpose, including model improvement
A provider may use information for the immediate answer, loan servicing, fraud controls, quality assurance, analytics, product improvement or development of an AI model. Those purposes can involve different systems and different retention periods.
Questions to ask
- Is my information used only to answer my current question, or also for servicing, fraud detection, analytics, testing, support or product development?
- Are prompts, transcripts, uploaded documents or extracted fields used to train, fine-tune, evaluate or improve a model?
- Can I opt out of model training or secondary uses before submitting data? Does an opt-out cover data already collected?
- Is de-identification applied before information is used for analytics or model development? What identifiers are removed, and can the data still be linked back to me?
- Are human reviewers allowed to read conversations or documents for quality or safety purposes?
Get a yes-or-no answer about training and ask whether the lender’s policy differs from its AI vendor’s policy. “We do not train on your data” may mean the lender does not train a model while a contracted vendor can use data for service improvement, or it may apply only to a particular product tier. Ask for the exact contractual restriction and the scope of any opt-out.
Find out who can see mortgage documents
Access can extend beyond the person who answers your question. It may include loan officers, processors, underwriters, servicing teams, information-security staff, customer support, cloud-hosting personnel and an external model provider.
Free tools Windows power users keep installed
One-click scans. No signup required.
Questions to ask
- Which lender departments and affiliates can access my prompts, files and extracted data?
- Which cloud, analytics, identity-verification, document-processing or AI/model vendors receive or can access it?
- Do contracts prohibit vendors from selling the data, using it for their own advertising or training unrelated models?
- Is access limited by job role and business need? Are privileged accounts protected with multifactor authentication?
- Are accesses logged, reviewed and removed promptly when an employee or contractor changes roles?
- Can data be transferred across countries, and which legal and contractual safeguards apply?
Fannie Mae’s Selling Guide section A3-4-01, dated February 5, 2025, requires covered parties to protect confidential information, follow applicable privacy laws, limit disclosure and securely dispose of information. It says borrower NPI disclosure requires borrower authorization unless applicable law permits disclosure. This is a requirement for parties in Fannie Mae’s business relationship, not proof that every lender or AI provider follows an identical contract.
Ask how security controls protect the information
Privacy promises describe permitted use; security controls reduce the chance of unauthorized access. Ask for a plain-language description of administrative, technical and physical safeguards without requesting sensitive architecture details that should not be disclosed publicly.
Questions to ask
- Is data encrypted in transit and at rest, and who controls the encryption keys?
- How are production systems separated from development and testing environments?
- What safeguards protect uploaded files, backups, logs and temporary processing copies?
- How are vulnerabilities discovered, prioritized and fixed? Are independent security assessments performed?
- What security and privacy training is required for employees and contractors?
- How are vendors assessed before access is granted, and how is their compliance monitored?
The FTC Safeguards Rule describes a written information-security program with administrative, technical and physical safeguards for covered institutions. Ask the lender which parts of its program govern the assistant and how vendor access is incorporated. A certification logo or a generic statement that data is “secure” does not answer who can access your file or what happens to copies.
Pin down retention, deletion and backups
Deletion is often more complicated than pressing a button in a chat window. A conversation may be copied into an application record, audit log, fraud system, vendor queue or backup.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuestions to ask
- How long are prompts, transcripts, original uploads, extracted fields and derived scores retained?
- Does the retention period change when I close an account, withdraw an application or stop using the assistant?
- Can I delete individual messages and files, or only the entire account?
- How do I submit a deletion request, and how will you verify my identity?
- Does deletion propagate to AI vendors, subcontractors, logs and backups? If backups cannot be changed immediately, when do they expire?
- Which records must be retained for legal, accounting, servicing, fraud or regulatory reasons, and for how long?
- What secure-disposal method is used when records reach the end of their retention period?
Request a written description of the deletion workflow and its exceptions. Ask whether the provider will confirm completion and identify records that cannot be deleted because a legal or servicing obligation requires preservation.
Rank #4
Understand incident detection, response and notification
Ask what happens if credentials are stolen, an employee accesses the wrong file, a vendor is compromised or an attacker obtains documents. The answer should identify responsibility, escalation and communication—not merely promise that incidents are taken seriously.
Questions to ask
- How are unauthorized access, malware, data loss and vendor incidents detected?
- Who investigates and contains an incident, and which party coordinates the response?
- How will affected borrowers be contacted, through which channels and with what information?
- When will the lender notify regulators, business partners and law enforcement where required?
- Will you tell me what categories of my information were involved and what protective steps I should take?
- Does the vendor have a contractual deadline to notify the lender, and does the lender have a separate deadline to notify me?
Fannie Mae’s Information Security and Business Resiliency Supplement says covered business partners subject to that Supplement must report cybersecurity incidents to Fannie Mae within 36 hours of identification. The page lists implementation dates of August 12, 2025, for single-family sellers and servicers and multifamily lenders; December 31, 2025, for technology service providers; and April 1, 2026, for document custodians. This is a partner-reporting requirement, not a universal deadline for notifying borrowers or regulators.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.“Fannie Mae recognizes that cyber risk is a business risk and protecting data is a shared responsibility.” — Fannie Mae, Information Security and Business Resiliency Supplement.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Determine whether the assistant influences a mortgage decision
An assistant that explains terminology or estimates a payment is different from one that routes an application, recommends an action, flags fraud, assigns a risk category or contributes to underwriting and pricing.
Questions to ask
- Is the assistant informational only, or can its output influence eligibility, pricing, underwriting, servicing, fraud review or another consequential decision?
- Which human employee reviews an AI-generated recommendation before action is taken?
- Can I correct inaccurate income, employment, identity or property information, and will the correction be considered?
- If an application is denied, counteroffered or priced differently, how can I obtain the specific reasons?
- How are model errors, bias and inconsistent answers tested and escalated?
The Consumer Financial Protection Bureau said on September 19, 2023, that creditors using complex models must provide specific and accurate adverse-action reasons. Generic sample reasons are inadequate when they do not reflect the actual reason for the decision. That guidance concerns creditors and credit decisions; it does not mean every chatbot reply is an adverse action. If the assistant influences a credit outcome, ask how the lender supplies a precise explanation and human review.
“Technology marketed as artificial intelligence is expanding the data used for lending decisions, and also growing the list of potential reasons for why credit is denied,” — Rohit Chopra, CFPB Director, September 19, 2023.
Obtain and reconcile the written disclosures
Ask for the current privacy notice, terms of use, AI-specific disclosure, vendor or subprocessors list, retention schedule and instructions for access, correction and deletion. Note the publication or effective date and the entity that issued each document.
Compare two providers using the same worksheet
| Comparison axis | What to record |
|---|---|
| Data collected | Inputs, uploads, transcripts, technical logs and derived records |
| Purposes and training | Immediate service, servicing, fraud, analytics, model development and opt-out scope |
| Recipients | Lender teams, affiliates, cloud hosts, AI vendors and subcontractors |
| Safeguards | Access controls, encryption, monitoring, testing and vendor oversight |
| Retention and deletion | Time periods, exceptions, backups and confirmation process |
| Incidents | Detection, responsibility, vendor notice and borrower communications |
| Decision role | Informational versus eligibility, pricing, underwriting or servicing influence |
| Human review | Correction route, appeal process and specific explanations |
If a chat response conflicts with the written notice, pause and ask the provider to resolve the discrepancy in writing. A marketing statement is not a substitute for the terms that govern your data.
Red flags that warrant a pause
- The provider cannot identify the legal entity responsible for the assistant.
- It says “we may use data to improve services” without defining whether that includes model training or human review.
- It lists vendors but does not state what each vendor may do with your information.
- It offers no retention period or says deletion is impossible without explaining legal exceptions.
- It cannot distinguish a lender’s obligations from a vendor’s obligations.
- It refuses to say whether an AI output can affect a credit decision or who reviews it.
- It promises notification “as soon as possible” without identifying the responsible party or communication process.
A practical pre-upload checklist
- Identify the exact lender, broker or service provider operating the assistant.
- Obtain the current privacy notice, AI disclosure and vendor information.
- Ask the collection, purpose, sharing, training, security, retention, incident and decision-role questions above.
- Enable the minimum account and conversation features needed for your task.
- Upload only documents necessary for the specific question or application step.
- Save the provider’s written answers, document dates and any opt-out confirmation.
- Use the stated correction, access or deletion process and keep its confirmation number.
- Escalate unresolved contradictions to a human privacy, compliance or loan representative before submitting additional NPI.
The safest choice is not determined by whether an assistant uses the word “AI.” It depends on transparent data practices, limited access, enforceable vendor controls, defined retention and deletion, a credible incident process, and meaningful human review when an automated system affects your mortgage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
