What's inside

• The regulatory map — TRID, Reg Z, ESIGN, GLBA, HMDA, FCRA, PCI — each mapped to a platform mechanism
• The TRID six-item application clock, and the "six pieces by text" trap
• Field-level PII encryption, access auditing, and the HMDA demographic firewall
• AI with a firewall: documents and identifiers never sent to an outside model; redaction and a log on every assistant call
• External scan results and the SOC 2 certification path

9 pages · PDF · Version 1.1 · October 2026

Second edition, October 2026: a new §12 covers the controls that shipped since the first — row-level security in the database for admin query tokens, one egress policy for every outbound call a lender configures, database access by managed identity, a consent gate beneath every text sender, the borrower's language on the consent record — and two earlier claims are restated in narrower words.