Mortgage AI built with security and compliance at the core.
Addy AI is SOC 2 Type 2 compliant. We're committed to compliance, data security and privacy, protecting your data and meeting top enterprise security and compliance standards.
Enterprise-grade security for mortgage AI.
Mortgage runs on documents that carry the most sensitive details of a borrower's life. Before we shipped a single agent, we built the controls underneath it, so loan officers can move faster without ever moving outside the lines.
Our six security and compliance principles behind every AI Agent action.
Encryption everywhere
Data is encrypted at rest with AES-256 using 256-bit data encryption keys across all databases, data stores, and file systems. Data in transit uses TLS 1.2+, including external transmissions and sensitive email.
Least-privilege access
Role-based access, SSO and SCIM provisioning, hardware-key MFA for all employees, and time-bound, audit-logged production access.
Tenant isolation
Per-lender logical isolation across storage, queues, and model contexts. Your loan data is never used to train shared models.
Continuous monitoring
24/7 anomaly detection, vulnerability scanning, dependency review, and quarterly penetration tests by independent third parties.
Responsible AI
Model outputs are constrained, traceable, and reviewable. We log prompts and tool calls so every agent action can be audited end-to-end.
Incident response
On-call runbooks, customer notification SLAs, and post-incident reviews. Status and security advisories published transparently.
Every policy, every control, in one place.
A summary of how Addy AI operates as a security organization. Expand any topic for detail. SOC 2 reports, completed questionnaires, and policy documents are available under NDA.
Who we are as a security organization, and the audited frameworks we operate under.
How the platform is built, how data flows through it, and how we protect what's inside.
Who can touch what, and the systems we trust to run beneath the product.
The day-to-day discipline that keeps the system trustworthy over time.
Deployed inside the systems of record for American lending.
We don't ask lenders to move their data to us. Addy operates inside the platforms that already pass their security reviews, under their controls, their auditors, and their procurement.
The institutions and programs supporting our work.
Frequently asked questions
- Do you train models on our borrower data?
- No. Customer data is never used to train shared or third-party foundation models. Tenant data stays isolated to your workspace.
- Where is data hosted?
- With an enterprise-grade cloud provider. All data is encrypted at rest with AES-256 using built-in key management.
- How do you handle subprocessors?
- Our subprocessor list is published in the Trust Center with change notifications. All subprocessors are reviewed against our security and privacy criteria.
- Can we get your SOC 2 report and pen test summary?
- Yes. Request them through the Trust Center. Reports are released under NDA, usually within one business day.