Protect borrower data by treating the entire mortgage workflow—not just the lender’s loan-origination system—as the security boundary. Inventory the personal information moving through intake, origination, settlement, and servicing; restrict and review access; encrypt information in storage and transit; assess every application and service provider; require multifactor authentication; and define retention, secure disposal, and incident-response procedures. The exact legal duties depend on the institution’s regulator, role, applicable law, and contracts.
What borrower information should a mortgage lender protect?
Mortgage application information is sensitive financial information. The FTC’s GLBA Privacy Rule compliance guide identifies information a consumer provides to obtain a financial product—including a name, address, income, and Social Security number—as nonpublic personal information (NPI). Transactional and service-related information can also be NPI.
Protect more than the initial application form. Information and documents can move among employees, borrowers, brokers, lenders, settlement providers, servicers, and technology vendors. The CFPB’s Regulation X overview describes mortgage-related stages including applications, origination, settlement, and servicing. Each transfer, copy, integration, and account is part of the protection boundary.
How do I protect borrower data when automating mortgage workflows?
Start with a written, risk-appropriate security program, then make its controls concrete across the workflow. The FTC Safeguards Rule applies to covered financial institutions and calls for administrative, technical, and physical safeguards suited to the organization’s size, complexity, activities, and the sensitivity of the information. Its guidance also says covered companies must protect customer information of other financial institutions when they handle or maintain it. Automation and outsourcing do not by themselves remove those responsibilities.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
1. Map data, systems, people, and vendors
Build an inventory of the information ecosystem, as the FTC recommends in its Safeguards Rule business guidance. For every workflow step, record:
- Which fields and documents are collected, created, or received.
- Where each copy is stored, including applications and vendor environments.
- Which employee, service-provider, or integration accounts can access or transmit it.
- Which systems exchange it and what purpose each exchange serves.
- How long the information is needed and how it will be securely disposed of.
Use the map to find unnecessary copies, uncontrolled exports, broad vendor permissions, and handoffs that lack an accountable owner. Update it when a workflow, application, provider, or data use changes.
2. Limit access and review it regularly
Give each employee and service-provider account only the access needed for its role. Separate duties where appropriate, remove access when a person or provider no longer needs it, and periodically review permissions—including access granted through integrations and shared accounts. The FTC lists access controls and recurring access review among the Safeguards Rule program elements.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Make the review operational: assign an owner, compare access against current job or service needs, record approvals and removals, and follow up on exceptions. A vendor’s account should be treated as access to borrower data, not as an administrative detail outside the lender’s controls.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →3. Encrypt information and assess the software path
Use encryption for customer information both at rest and in transit. Assess applications that store, access, or transmit the information, including third-party applications. Review how data enters and leaves each system, what protections apply to integrations and exports, and whether the provider’s access and security practices meet the institution’s requirements.
Encryption is one safeguard, not a substitute for controlling accounts, reviewing applications, or deciding whether the data should be shared in the first place. Document the applications and transfers in the inventory so that protections cover the full path rather than only a primary database.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
4. Require multifactor authentication
Use MFA for access to systems containing borrower information, including employee and vendor access where appropriate. FTC guidance recognizes factor types based on knowledge, possession, and inherence; MFA requires at least two factor types. The guidance allows an equivalent control instead only when the qualified individual approves it in writing.
Choose an implementation that fits the lender’s identity platform and account-recovery process, is usable and appropriately strong for staff and vendors, supports centralized enrollment and revocation, and produces useful audit records. A FIDO2 security key can serve as a possession factor, but no single device is a complete security program or automatically establishes compliance.
5. Set retention and secure-disposal rules
Define retention by data type, workflow purpose, applicable recordkeeping obligations, and contractual requirements. FTC Safeguards Rule guidance says covered information should be securely disposed of no later than two years after its most recent use to serve the customer, subject to exceptions when legitimate business or legal needs require retention or targeted disposal is infeasible. Apply the full rule and any other applicable retention duties before deleting records.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Disposal procedures should address information in all relevant locations, such as system records, exports, and provider-held copies. Make deletion responsibilities and evidence of completion part of vendor and workflow procedures, rather than assuming that closing a loan or disabling an account removes every copy.
6. Plan incident response and contractual notices
Establish how staff and service providers identify, escalate, investigate, and contain suspected exposure of borrower information. Make reporting channels and responsibilities clear, preserve relevant records, and determine who evaluates legal, regulatory, and contractual notification duties.
For business partners subject to Fannie Mae’s Information Security and Business Resiliency Supplement, the current Supplement page describes a 36-hour incident-reporting requirement to Fannie Mae after identification for covered cybersecurity incidents. Applicability depends on the partner category and Supplement requirements; this is not a universal statutory breach-notification deadline.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBest Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
How should mortgage teams handle data sharing and service providers?
Before automating a disclosure, identify the information, recipient, purpose, authority, and applicable contract. Fannie Mae’s Selling Guide A3-4-01 requires relevant seller/servicers to safeguard NPI and generally obtain borrower authorization before disclosure unless applicable law permits it. It also addresses secure destruction. The guide’s requirements attach to the relevant seller/servicer relationship; they should not be assumed to govern every mortgage business in the same way.
Check service-provider arrangements for permitted uses, access restrictions, safeguards, incident escalation, retention and disposal, and any required cooperation with the lender’s reviews. Map the provider’s role in the workflow and confirm that the data shared is limited to what the task requires. The FTC’s Safeguards Rule guidance separately addresses covered companies handling or maintaining another financial institution’s customer information.
Legal duties vary by regulator and business role. The FTC’s Safeguards Rule guidance, GLBA privacy requirements, Fannie Mae guide and supplement requirements, state privacy and breach-notification laws, other regulators’ rules, and lender-specific contracts may apply differently. Fannie Mae’s Selling Guide A3-2-01 addresses compliance with applicable laws, including borrower privacy. Determine which requirements apply to the institution and its exact workflow rather than treating any one source as a universal rule.
What should a practical implementation checklist include?
- Maintain a current map of borrower data, documents, systems, users, providers, transfers, and deletion points.
- Restrict access by role, review permissions periodically, and promptly remove access that is no longer needed.
- Encrypt information in storage and transit and assess the applications and providers handling it.
- Require MFA using an institution-approved implementation, with controlled enrollment, recovery, revocation, and auditability.
- Set retention and secure-disposal procedures that account for applicable legal and business needs.
- Verify disclosure authority, borrower authorization where required, and contractual limits before automating sharing.
- Maintain incident-response procedures and track each applicable contractual or legal notice requirement separately.
As FTC Bureau of Consumer Protection Director Samuel Levine put it in the agency’s Safeguards Rule announcement: “Financial institutions and other entities that collect sensitive consumer data have a responsibility to protect it.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
