Security & privacy
You are not the product.
Handing a stranger your mortgage paperwork is a real thing to ask. Here is exactly what happens to it, who can see which parts, and what we would have to do wrong for that to change.
What happens to your document
- 1
It arrives encrypted
Your file is uploaded over TLS straight into a private store. It is encrypted at rest. It is never placed in a public bucket, and the storage path is not guessable.
- 2
Identity is stripped, not hidden
We extract the loan figures, then produce a separate redacted copy. Your name, street address, phone, email and any Social Security number are removed from that copy — not covered over, removed. The redacted copy is the only version a lender can reach.
- 3
Your contact details are quarantined
They are stored in a separate table that no lender account has read access to under any policy. There is no role, no query and no dashboard through which a bidding lender can reach it.
- 4
Bidders see a loan file, not a person
A lender sees loan amount, LTV, credit band, property type, the state, the first three digits of the ZIP and the terms to beat. Not the full ZIP — paired with a loan amount, that can re-identify someone.
- 5
You choose, then exactly one lender learns who you are
Accepting a bid is the single event that releases your details, and it releases them to one lender. Everyone who lost the auction never finds out who they were bidding on.
We never sell your data
Not to lenders, not to data brokers, not to anyone. Our revenue is a flat fee from the one lender you pick. That is the entire business model, and it only works if you actually save money.
No credit pull to shop
Bidding runs off the credit band already printed on your Loan Estimate. Nothing we do touches your score.
Every bidder is verified
We check NMLS registration and state licensing before an originator can bid, and re-verify monthly. A lender can only see auctions in states where its licence is current.
Delete it all, any time
One click removes your documents, your auction and your account. Deletion is real deletion, and we confirm it in writing.
Least-privilege by construction
Access is enforced in the database itself through row-level security, not in application code. The bidder-facing view has no path to your identity — a mistake in our app code cannot expose what the query cannot reach.
No robocalls, ever
We don't operate a call centre and we don't hand your number to one. Communication runs through us until you choose a lender.
What we won’t claim
Where our promises stop.
Once you pick a lender, they're a lender
After you accept a bid, that company becomes your loan originator and its own privacy policy governs what it does with your information. We introduce you; we don’t sit inside their compliance department.
A bid is an indication, not a commitment
Competing offers here are non-binding until the lender issues you its own Loan Estimate. That document — not anything on this site — is what binds them.
We can't guarantee a saving
Sometimes your existing lender has already given you a strong deal. When nobody beats it, we tell you so plainly rather than inventing a winner.
We're early
BeatMyRate, Inc. is a new company. We haven’t completed a SOC 2 audit yet, and we’re not going to put a badge in the footer implying otherwise. When it’s done, it’ll be dated and linked here.
Questions about any of this?
Write to help@beatmyrate.com and a person will answer you.