Security

Borrowers and lenders trust us with business information. This is how we protect it.

• No sensitive identifiers. We do not collect Social Security numbers, bank credentials, ID images or financial documents.
• Payments. Card details are tokenized in your browser by our payment processor. Card numbers never touch LenderMatrix servers.
• Isolation by design. Each lender sees only the requests sent to it. Access is enforced on the server for every request, not just hidden in the interface.
• Account protection. Strong passwords, sign-in throttling, bot protection and uniform error messages that do not reveal whether an account exists.
• Secrets encrypted at rest and never shown again after they are saved.
• Verified webhooks. Billing notifications are cryptographically verified and processed exactly once.
• Audit trail. Administrative, billing and security events are logged.

Found a vulnerability? Please report it with steps to reproduce. Do not access other users’ data while testing.