Guide

Who should hold a lender’s loan data: the vendor, or the lender?

The lender answers for its loan data wherever it sits. That is easier when the data lives in an environment the lender owns, where its own administrators decide who gets in, the vendor has no standing access, and the data is already in the lender’s hands on the day a contract ends. Ask every vendor three things: where the data lives, who at the vendor can reach it, and what you get back when you leave.

Security and data handling

By Amit Ghole, President and CTO, inflooens · November 13, 2026 · General information, not legal advice.

Two models

Where loan data can live

Both are in wide use, and good products exist on each. They put different things in the lender’s hands.

  • Model A

    The vendor’s shared database

    Every customer’s data sits in one system the vendor runs, separated by the software. Simple to buy and to operate. Access, isolation and what happens at exit are whatever the vendor has built and the contract says.

  • Model B

    An environment the lender owns

    Each lender has its own environment, provisioned for it, with its own users and permissions. The lender controls who gets in. The vendor’s product runs inside it.

What changes

Six places the difference shows

None of these is visible in a demo. All of them come up in a vendor review, an audit or an exit.

Who decides who can see the data

Vendor’s shared databaseThe vendor’s permission system, administered through the vendor’s tool.

Environment the lender ownsThe lender’s own administrators, with the platform’s permissions.

Vendor staff access

Vendor’s shared databaseDefined by the vendor’s internal controls. Ask what they are.

Environment the lender ownsNone by default. The lender grants it for a purpose, and it ends.

Separation from other customers

Vendor’s shared databaseEnforced by the application.

Environment the lender ownsStructural. Another lender’s data is in a different environment.

Your own reports and extensions

Vendor’s shared databaseThrough whatever export or interface the vendor offers.

Environment the lender ownsWith the platform’s standard tools, on live data.

An examiner’s or auditor’s request

Vendor’s shared databaseYou ask the vendor for evidence.

Environment the lender ownsYou can show access, permissions and history from your own environment.

When the contract ends

Vendor’s shared databaseYou receive an export, in the vendor’s format, on the vendor’s timetable.

Environment the lender ownsThe data is already in an environment you hold. What happens to it is set by your agreement.

The exit

Settle the ending before the beginning

Nobody plans to leave a vendor they are about to sign with. That is the moment you have the most leverage to agree how it would work.

  • In what form

    A full, documented copy you can load elsewhere, not a set of spreadsheets. Ask to see a sample.

  • Including what

    Documents, conversation history and audit records, not only data fields. These are the parts that are hard to recreate.

  • By when

    A number of days, in the contract, with what the vendor keeps and for how long after that.

  • Deleted how

    Written confirmation that the vendor’s copies are gone, including any held by its own suppliers.

Why it falls on you

The lender stays responsible

Handing loan data to a vendor does not hand over the duty to protect it.

Sources checked on November 13, 2026. This is general information, not legal advice. Rules change, and your own counsel and compliance team decide how they apply to you.

Questions to ask any vendor

Where our data lives, and what we get back

Ask for the answers in writing. The last two belong in the contract.

  1. 1Is our data in an environment provisioned for us, or in a database shared with your other customers?
  2. 2Who at your company can reach our data today, and under what control?
  3. 3If your staff need access for support, who grants it and how does it end?
  4. 4Can we build our own reports and extensions on the live data, with standard tools?
  5. 5Which of your suppliers receive any of our data, and what does each keep?
  6. 6At the end of the contract, in what form and by when do we get our data, including documents and history?
  7. 7How do you confirm that your copies have been deleted?

How inflooens does it

Your org. Your data.

Stated in full on the Salesforce, security and privacy pages.

Where it lives
Every lender runs in a dedicated Salesforce org, provisioned for that lender and owned by it. Its data is not mixed with anyone else’s.
Who gets in
Users sign in to the lender’s org. What each person can see and do is set by the permissions the lender’s administrators control.
inflooens’ access
inflooens holds no standing access to a lender’s org. Our staff work in it only when the lender grants access for implementation or support.
Your own reports
Dashboards and reports use standard Salesforce tools on live loan data, and the lender’s administrators can add fields, automation and integrations.
The AI service
Luna AI’s service runs separately, receives requests with identifying data replaced or removed, and keeps no copy of loan data.
The system of record
The lender’s loan origination system remains its compliance system of record.
At the end
When an agreement ends, the lender’s data is returned or deleted as that agreement says.
Built on Salesforce Security and data handling Privacy policy

Straight answers

Questions about loan data

Who should hold a mortgage lender’s loan data?
The lender is responsible for it wherever it sits. It is easier to meet that responsibility when the data lives in an environment the lender owns and controls, with the vendor’s product running inside it, than when it sits in a database shared with the vendor’s other customers.
What is the difference between single-tenant and multi-tenant for a lender?
In a shared, multi-tenant system every customer’s data sits in one database, separated by the software. In a dedicated environment each lender has its own, with its own users and permissions. The difference shows in who controls access, how separation is enforced, and what happens when the contract ends.
What should a lender ask a vendor about data access?
Who at the vendor can reach the data today, under what control, and whether access for support is granted by the lender and then ends. “No standing access” is the answer to look for.
What happens to a lender’s data when it leaves a vendor?
That is set by the contract, so settle it before signing: the form of the data returned, whether it includes documents and history, the number of days, and written confirmation that the vendor’s copies are deleted.
Where does inflooens keep a lender’s loan data?
In a dedicated Salesforce org provisioned for that lender and owned by it. inflooens holds no standing access to it. Luna AI’s service runs separately, receives redacted requests and keeps no copy of loan data. When an agreement ends, the lender’s data is returned or deleted as that agreement says.

More guides

Keep reading

All guides for lenders

Send us your questionnaire.

We answer in writing, including where your data lives and how it leaves.

security@inflooens.com Or book a session with our architects