FTC Safeguards Rule
Each element of the Safeguards Rule, 16 CFR 314.4, and how an install meets it, with what Proxara holds and does not hold yet.
Updated 2026-10-16
The FTC Safeguards Rule, under the Gramm-Leach-Bliley Act, sets what a mortgage lender’s or broker’s information security program must do (16 CFR 314.4). The program is yours. Proxara is built so that its install sits inside it, and this page goes element by element.
Element by element
| Requirement | Section | How an install meets it |
|---|---|---|
| Access controls | 314.4(c)(1) | Sign-in through your Entra ID, assignment required, two roles, and no access for Proxara. Access and logging |
| Know the data and systems | 314.4(c)(2) | One install in your subscription, with every part and every connection listed. Architecture, Every connection |
| Encryption | 314.4(c)(3) | AES-256 at rest under your keys, and TLS 1.2 or higher in transit. Encryption and keys |
| Secure development | 314.4(c)(4) | Reviewed code and signed releases, each with a software bill of materials and a vulnerability check. Releases and updates |
| Multi-factor authentication | 314.4(c)(5) | Your Entra MFA applies to every sign-in. |
| Disposal | 314.4(c)(6) | Working copies deleted when the loan officer closes the loan, or after 90 days untouched (a number your shop sets), and every deletion logged. Retention and deletion |
| Change management | 314.4(c)(7) | Signed releases that your administrator chooses when to apply, with rollback. |
| Monitoring and logging | 314.4(c)(8) | Every sign-in, view, export, deletion and setting change logged by person, in your tenant. |
| Testing and monitoring | 314.4(d) | The install is yours to test like any system you own. Proxara answers what your testing finds and ships the fix as a signed release. |
| Overseeing service providers | 314.4(f) | Proxara receives no customer information. This Trust Center, the infrastructure code and the install itself are open to your review. |
| Incident response | 314.4(h) | Proxara tells affected lenders within 72 hours of confirming an incident in anything it ships. Incident response |
| Notice to the FTC | 314.4(j) | Proxara’s notice comes early enough for yours, for an event involving 500 or more consumers. |
The rest of the program, the qualified individual, the risk assessment, training and the report to your board, stays with your shop. An install adds one system to it, and this Trust Center describes that system for your risk assessment.
What Proxara holds and does not hold
Proxara does not hold a SOC 2 report yet. Because borrower data never leaves your environment, the product runs inside the controls your own audits and exams already cover, and your team can inspect the install itself: the infrastructure code before it runs, and every resource, role and log after.