Trust & Compliance

Last updated: August 8, 2026

RateSignal is built for a regulated industry, and the people who evaluate us are often compliance officers, not marketers. This page is written for them — plain answers about what data the service touches, what it never touches, and the legal footing it runs on.

The service-provider model

When a loan officer, branch, or lender provides borrower information to RateSignal, we process it solely as a service provider acting on that customer’s behalf — the arrangement federal privacy law (the Gramm-Leach-Bliley Act and its implementing regulations) contemplates for financial institutions that engage vendors to serve their own customers.

In practice that means your borrower list remains your book of business. It is used only to monitor rates and perform outreach in your name, to your borrowers, about your services. It is never sold, never pooled across accounts, never shared with nonaffiliated third parties except vendors necessary to deliver the service under confidentiality obligations, and never used to market anything other than you.

What we work with — and what we never collect

The service runs on a deliberately minimal data set:

• Borrower name and contact information — so outreach carries your voice
• Current interest rate
• Loan amount
• Property value

The service provides no fields for the following, and they must not be submitted in any form:

• Social Security numbers
• Dates of birth
• Credit reports or credit scores
• Income or employment records
• Bank or financial account numbers
• Loan files, applications, or supporting documents

If prohibited data reaches us inadvertently, it is deleted.

Public record vs. nonpublic information — the honest version

Some of what RateSignal works with overlaps with the public record: when a mortgage closes, the recorded mortgage or deed of trust — borrower name, lender, original loan amount, property, closing date — is filed with the county and available to anyone. But the promissory note is not recorded, so an exact interest rate generally is not public, and phone numbers never appear in land records.

More to the point: privacy law looks at where your copy of the data came from. A borrower list exported from a loan origination system was collected through the lending relationship, and we treat all of it as nonpublic personal information — regardless of what could be reconstructed from county files. You will not find a “it’s all public anyway” argument on this site, because it would be wrong.

Your authorization

Possessing your clients’ names, rates, and contact information is your job. Moving that data into a third-party tool is a decision your company may govern. Our Terms of Service require every customer to confirm they are authorized to provide the data they upload — and if your company owns the borrower relationship, the right way in is together: Branch and Enterprise accounts exist so compliance signs once and every loan officer benefits.

Outreach and the TCPA

Borrower outreach through RateSignal is consent-based and designed for compliance with the Telephone Consumer Protection Act and applicable do-not-call rules — these are your clients, contacted in your name, using contact information you already hold. Customers control the script, the callback number, and the branding. Monitoring runs around the clock, but no one is texted at 2 a.m.: outreach respects sensible calling windows in the borrower’s time zone. Customers are responsible for holding the consents their outreach requires; the service is built to operate within them.

Security and retention

• Borrower data is encrypted in transit and at rest
• Each account’s data is isolated — no cross-account pooling, ever
• Access is limited to what operating the service requires
• On termination, customer data is deleted on request, and in any event within 30 days

For compliance officers

If you are evaluating RateSignal for your branch or institution, we will walk your compliance team through the data flow and execute a service-provider agreement reflecting the commitments on this page. Reach us through our contact page.

This page describes how the service is designed and operated. It is not legal advice, and it does not modify the Terms of Service or Privacy Policy.