Updated October 4, 2026. This overview describes LoanBook application controls and the scope of our supporting infrastructure.
LoanBook uses Supabase Auth to verify account sessions. Sign-in uses an individual password or a time-limited email sign-in link. Two-factor authentication is not required for any role. Account eligibility and role permissions still govern protected access.
Server-side authorization checks account status, role and applicable resource permissions. User management is available to Owners through the Workspace user menu. Customer workspace access, internal desk access and CRM permissions are separate controls.
Public offering information is separate from restricted portfolio and data-room content. Restricted workflows check the relevant account, portfolio or room permissions. Share links and invitations should be treated as confidential credentials and distributed only to intended recipients.
API and OAuth credentials have server-enforced scopes and revocation checks. Credentials linked to a user are also subject to that account’s active status and access expiration. Credential hashes and authorization records are managed through server-side operations.
Authentication and authorization changes are checked with automated regression tests, including denied-access scenarios. Database permission changes are tested against disposable database fixtures before rollout. These engineering checks are distinct from an independent penetration test or assurance report.
LoanBook uses Vercel for application hosting and Supabase for authentication, database and storage services. Supabase documents TLS encryption in transit and AES-256 encryption at rest for its hosted customer data. LoanBook remains responsible for application permissions, data sharing and configuration.
Review Vercel security information and Supabase security information for those providers’ controls. Provider certifications apply to their own services and do not constitute a LoanBook certification.
Send your security questionnaire and required evidence to our team before onboarding confidential data. We will identify the materials available and any requirements that need additional work. Review topics may include data flows and subprocessors, retention and deletion, incident notification, backup and recovery, access reviews, and independent testing.
This page does not assert a LoanBook SOC 2 report, ISO 27001 certification, regulatory approval or an independent penetration-test attestation. Requirements and contractual commitments should be confirmed directly with LoanBook.
Request a security reviewContact support@theloanbook.com with the affected page, approximate time and a description. Do not include passwords, access tokens, borrower records or other sensitive data in the initial email. Request a suitable channel for sensitive evidence.
