Security questions
The questions an IT or security lead asks first, answered.
Updated 2026-10-18
The questions an IT or security lead asks first, answered in the open. Anything not here goes to security@proxara.ai.
Where it runs
Where do borrower files go?
Nowhere outside your environment. Proxara runs in your own Azure tenant, or on your own servers for an additional fee. The documents, the model and every result stay there.
Is our environment shared with anyone?
No. Each lender’s install is its own: its own network, GPU, storage and keys, in its own subscription. Proxara holds no credential or role in it.
Can it run on our own servers?
Yes, for an additional fee. The same signed release runs on a GPU server in your office or data center, with the same controls. The boundary is then your own network.
Does it send telemetry?
No. There is no analytics or crash reporting from your install, and no heartbeat unless your IT switches one on. Every outbound connection it makes is listed in Every connection.
Protection
How is the data protected?
AES-256 at rest under keys in your own Key Vault, and TLS in transit. People sign in with their Microsoft accounts under your MFA rules, and every view and export is logged by name.
Can Proxara see our data, even for support?
No. Proxara has no account, credential or role in your environment. For support, your IT can export a diagnostics bundle of versions, timings, error types and health, and send it if they choose. It carries no borrower data.
How long is anything kept?
As long as the loan is worked: an open loan is never deleted on a timer. Its files go when the loan officer closes it, or after 90 days untouched, and your shop can set its own number. Every deletion is logged, and the result PDFs stay in your systems under your retention.
The model
Can the model get a number wrong?
The model only reads. Every fact it takes points at the words it came from on the page. Code works out every number from the published rules, and nothing is approved until DU or LP says so.
Is our data used to train a model?
No. Nothing from your environment reaches Proxara, so nothing of yours can train any model, ours or anyone else’s. The model in your install is a fixed, pinned version.
Does it make credit decisions?
No. The AUS and your underwriters decide, and a person at your shop decides every loan. Proxara applies the published agency and lender rules, none of which uses a characteristic the Equal Credit Opportunity Act protects, and it never produces an adverse action notice.
Operations
What if Proxara goes down?
Nothing stops. It runs in your tenant and needs nothing from Proxara to keep working. New releases simply wait until you take them.
How do updates reach us?
As signed releases your install pulls and verifies before anything runs. Your administrator chooses when to apply an application or model release, with rollback; rule releases arrive hourly and apply from their own effective dates.
What happens if we stop using Proxara?
Delete the install’s resource group and its app registration in your Entra ID. Every resource and every record is already yours, so there is nothing to hand back and nothing left with Proxara.
How can our team check all this?
The install is declared as code, so your team can read every resource before anything runs. After it runs, they can verify each image’s signature and confirm that no identity outside your tenant holds a role.
Compliance
Do you hold a SOC 2 report?
Not yet. Because borrower data never leaves your environment, the product runs inside the controls your own audits and exams already cover, and your team can inspect the install itself.
How does it fit the FTC Safeguards Rule?
Element by element in FTC Safeguards Rule. The program stays yours, and the install is one more system inside it.
Would you tell us about an incident?
Yes. Proxara tells every affected lender within 72 hours of confirming an incident in anything it ships, and says what to do. Incident response has the steps.
The sandbox
Is the sandbox the product?
No. The sandbox at restructure.proxara.ai is a working copy of Encompass with sample loans, in Proxara’s own environment, where you can watch Proxara work a loan to approval in DU. Real borrower files belong in your own install.