Security overview

CloneALO does not accept live borrower data. Live borrower data is disabled by a server-side switch, and borrower PII writes are refused by the backend while it is off. The application will remain in synthetic-only mode until the production data gate is cleared, including an independent penetration test and written approval from each brokerage.

• TLS in transit and encryption at rest for all stored data.
• Field-level AES-256-GCM encryption for Social Security numbers, with the key held server-side only. Ciphertext lives in a table no application role can read.
• Only the last four digits of an SSN are ever queryable. Revealing the full value requires a stated reason and writes an immutable audit record.
• Documents are stored privately and served through short-lived signed URLs.
• No production borrower data is copied into development environments.

• Row-level security scopes every borrower record to its company. A valid login is not authorization.
• Least-privilege roles, with compliance access granted deliberately and logged.
• Automated tests assert that one company cannot read, change, download, search, or ID-guess another company's data.
• Every view, unmask, grant, and revoke of borrower data is recorded in an append-only log.

• Server-side authorization on every action; client-side role state is never trusted.
• Strict content security policy, framing protection, HSTS, and hardened response headers.
• CSRF protection on server functions and rate limits on authentication, PII unmasking, sharing, and export.
• Schema validation on every server boundary, with file type and size limits.
• Redacted logging: no SSNs, tokens, or document contents reach a log line.

Remediation targets by severity. P0 means containment first: revoke sessions and tokens, preserve evidence, engage counsel and insurer, and restore only after validation.

Active exploitation / P0

Contain immediately, revoke sessions and tokens, preserve evidence, engage counsel and insurer, restore only after validation.

Critical

Fix or disable the affected functionality within 24 hours.

High

Fix within 7 days.

Medium

Fix within 30 days.

Low

Fix within 90 days.

Report suspected vulnerabilities to the security contact listed by your CloneALO representative. Please include reproduction steps and avoid accessing, modifying, or retaining any data that is not yours. We will acknowledge receipt, keep you updated, and will not pursue action against good-faith research that follows this policy.

See also our subprocessor list and privacy policy.