Applicant data handled the way a bank would expect
Loan files hold some of the most sensitive data a person shares. GIX Verify builds each control into the platform, so it cannot be skipped from the screen.
Data stays in India
Applicant data and documents are stored and processed in data centres in India.
Two-factor sign-in
Every lender user signs in with a password and an authenticator code.
Maker and checker
Closing or waiving a flag needs a second person with the right role, never the person who raised the file.
Each lender sees only its own data
Separation between lenders is enforced by the database on every request, not just by the screens.
Tamper-evident audit trail
Every check, comment, override and download is recorded, and each record is sealed to the one before it.
Consent and privacy built in
Applicant consent is recorded before data is fetched, used only for the stated purpose and deleted on schedule.
How access works
Every user belongs to one lender and has one role: maker, checker, FCU manager, viewer or admin. The database checks the lender and the role on every request, and the screens only show what the database allows.
- Branch and sales users see the files they raised and their screening status.
- FCU and credit users see flags and evidence for their lender's files, and can close a flag only with a reason.
- Waivers and overrides need a second person with the right role.
- GIX staff cannot open a lender's documents unless the lender grants time-limited support access.
Where data lives
Applicant data and documents are stored and processed in data centres in India, encrypted in transit and at rest. Documents sit in private storage and open only through links that expire within minutes.
Consent and retention
- Applicant consent is captured and recorded before any outside source is queried.
- Data is used only to screen that loan application for that lender.
- Records are kept for the period agreed with the lender and required by law, then deleted.
Operations and resilience
- Encrypted backups every night, with a written restore procedure.
- Automated health checks around the clock, with alerts to our team.
- Secrets held only in protected server settings, never in code that reaches a browser.
- Independent security testing before go-live and at regular intervals.
Reporting a security issue
If you believe you have found a security issue, please contact us through the contact page. We take every report seriously.