Security & data handling
Stored in Sydney. Parsed by code we wrote. Never fed to an AI.
A commission statement is your clients’ personal information. MyLoanBook reads it with purpose-written, tested code on Australian infrastructure. No large language models, no offshore processing of your book, no training on your data. This page sets out exactly what happens to a statement after you upload it, every service we use, and where each one runs.
Last reviewed September 2026. Read it alongside our Privacy Policy and Terms.
Four commitments
What we commit to.
No AI touches your data
Every statement is parsed by deterministic code we wrote and test against real, anonymised statements. There is no AI or machine-learning dependency in the product. Nothing you upload is sent to OpenAI, Anthropic, Google or any other model provider, and nothing is used to train one.
Stored and processed in Sydney
Your database, authentication, file storage, rate limiting and the servers that parse your statements all run in the AWS Sydney region (ap-southeast-2). Your book is not processed offshore.
One broker, one book
Isolation is enforced by the database itself, not by application code: every table carries a row-level security policy tying each row to the broker who owns it. Multi-factor authentication is mandatory for every account.
Your data, your call
You own what you upload. Export everything to a spreadsheet at any time, or ask us to delete your account and we complete it within 30 days. We do not sell your data, use it for advertising, or pass it to lenders or aggregators.
Step by step
What happens to a commission statement.
You upload the file over an encrypted connection
Uploads are accepted only from a logged-in, MFA-verified session, only in spreadsheet formats, and only up to 10 MB.
We check it is yours and new
The file is fingerprinted with SHA-256. A statement you have already uploaded is rejected as a duplicate rather than double-counted, and a statement containing more than one broker's data is refused outright.
Deterministic code reads it, in Sydney
The adapter for your aggregator's format (LMG today) reads each row and turns it into commission records, loans and clients. It is ordinary, tested parsing code: no model, no external service. The maths that follows, run-off, clawback windows and valuation, is pinned by a golden-master test suite so the same file always produces the same figures.
Rows land in tables only you can read
Records are written under your broker ID. The database refuses any query that is not scoped to you, whatever the application asks for.
The original file sits in your private folder
The spreadsheet is kept in a private, access-controlled bucket in Sydney under your account so you can download it again. Nothing but the parser and your own download requests ever read it, and it is removed when your account is deleted.
You can take all of it with you
Every table exports to a spreadsheet from Settings. Deletion requests are verified and completed within 30 days.
Our position
Why we don’t put your book through an AI.
A commission statement is not just numbers. It names your clients, their lender, their loan balance and when they settled. That is personal information under the Privacy Act 1988, and it is confidential under your aggregator agreement. You are accountable for it, and so are we once you upload it.
Pasting or piping that file into a third-party language model is a disclosure to the model's provider. The Office of the Australian Information Commissioner says as much in its guidance on commercially available AI products, and recommends that organisations do not enter personal information into publicly available generative AI tools at all. We agree, and we built the product so the question never comes up.
There is a second reason. Language models are probabilistic; commission maths should not be. When a clawback estimate or a book valuation looks wrong, you need to trace exactly why. Our engines are plain code with a test suite that pins the output of real, anonymised statements, so the same file always gives the same result, to the cent.
If we ever add an AI-assisted feature, it will be opt-in, we will name the provider and where it runs, it will not see a statement you have not chosen to share with it, and this page will change before the feature ships. From 10 December 2026 the Privacy Act also requires organisations to disclose automated decision-making in their privacy policy. We have nothing to disclose.
“…organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.”
Recommended practice
Office of the Australian Information Commissioner, Guidance on privacy and the use of commercially available AI products, October 2024.
Every service we use
Where your data lives.
Your commission statements, clients and loans are stored and processed only in Sydney. A small number of supporting services run overseas and receive only what they need to bill you or deliver a message you asked the app to send.
| Service | What it does | What it receives | Where it runs |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Your account, commission records, clients, loans and uploaded statements | Sydney, AWS ap-southeast-2. SOC 2 Type 2, ISO 27001. AES-256 at rest |
| Vercel | Application hosting | Runs the app and the statement parser | Functions pinned to Sydney (syd1); static site files on a global CDN. SOC 2 Type 2, ISO 27001 |
| Upstash | Rate limiting and job queue | Request counters, and the queue that hands outgoing email and SMS jobs to the delivery services | Redis in Sydney, AWS ap-southeast-2 |
| Stripe | Billing | Your name, email and payment details. Card numbers never touch our servers. No client data | United States. PCI DSS Level 1 |
| Resend | Transactional email | The address and content of emails the app sends: account notices and your weekly summary to you, and client emails you choose to send | United States |
| Twilio | SMS | The mobile number and text of SMS you choose to send | United States |
| Sentry | Error monitoring | Technical error reports; personal-data collection is switched off | United States |
| Google Analytics | Usage analytics | Anonymous usage events; no names, emails or client data | Global |
Where a provider is overseas, we choose providers with contractual safeguards consistent with Australian Privacy Principle 8, and we limit what they receive to the job in front of them. If we add or replace a service, this table changes first.
Controls
The controls behind the promises.
Access
Every account must enrol an authenticator app. A session without it is challenged before it can reach any client data or API. Changing a password requires the current one.
Isolation
Row-level security on every table, keyed to the broker who owns the row. Firm owners, brokers, admin staff and view-only users each see only what their role allows, again enforced in the database. We test isolation with automated cross-tenant access probes and re-run them when a policy changes.
Encryption
TLS on every connection; the app is served only over HTTPS. AES-256 encryption at rest for the database and file storage, provided by Supabase on AWS in Sydney.
Uploads
Type and size checked, fingerprinted for duplicates, stored privately under your account. No file is ever executed, only read.
Logging and monitoring
Application code is prohibited by a lint rule from logging client or loan data. Error monitoring runs with personal-data collection switched off. Any support access to an account is recorded: who, what and when.
Abuse protection
Every API is rate-limited, and if the rate limiter is unreachable the app refuses requests rather than letting them through. Webhooks and background jobs are signature-verified; the privileged database credential is only ever used server-side.
Ownership
Your data, your call.
It stays yours
You retain ownership of everything you upload, including your clients' information. We hold a licence to process it solely to run the service for you.
Take a copy any time
Settings exports every table to a spreadsheet, one sheet per table. Reports export to PDF and CSV.
Leave cleanly
Request deletion from Settings (we ask for your password again), we cancel billing, and we complete the deletion within 30 days. We may use de-identified, aggregated patterns to improve the product; we never use your data to train a model, because there is no model.
If something goes wrong
Breaches and reports.
Breach notification
We operate under the Notifiable Data Breaches scheme. If we suspect an eligible breach we assess it within 30 days, and we notify affected brokers and the OAIC as soon as practicable, with what happened, what data was involved and what to do next.
Found a vulnerability?
Email nick@digitalbrokerlabs.dev. We welcome good-faith reports and reply within one business day.
Straight talk
Where we are honest about our limits.
We are a small Sydney company. We do not yet hold a SOC 2 or ISO 27001 certification of our own; the providers that run our infrastructure do, and we lean on their controls. We have not yet commissioned an independent penetration test. We test cross-tenant isolation ourselves, we keep client data out of logs and out of AI tools by construction, and we would rather tell you exactly where we stand than imply otherwise. When any of this changes, this page will say so.
FAQ
Questions brokers ask.
Do you use ChatGPT or any AI to read my commission statement?
No. Statements are read by parsing code we wrote for each aggregator format. There is no AI or machine-learning library in the product and no data is sent to a model provider. We treat that as a design rule, not a setting.
Where is my data stored?
In Sydney. The database, authentication, file storage and the servers that process your statements all run in the AWS Sydney region, ap-southeast-2.
Does anything leave Australia?
Your statements, clients and loans do not. Three delivery services are US-based and receive only what they need: Stripe handles your billing, and Resend and Twilio deliver the emails and SMS you choose to send from the app.
Do you keep my original commission file?
Yes, in a private folder under your account in Sydney so you can download it again. Only the parser and your own downloads read it, and it is removed with your account.
Who can see my clients' data?
You, and anyone you add to your firm with a role that allows it. Isolation is enforced by row-level security in the database, and every account needs an authenticator app to log in.
Can I delete everything?
Yes. Request deletion from Settings, we verify it, and we complete it within 30 days. Export first if you want a copy: every table downloads as a spreadsheet.
Do you share data with lenders or aggregators?
No. No aggregator or lender owns, funds or receives data from MyLoanBook. We read their statements so you can see what you were paid.