FTC Safeguards Rule
Each element of the Safeguards Rule, 16 CFR 314.4, and how Proxara meets it as your service provider, with what it holds and does not hold.
Updated 2026-10-31
The FTC Safeguards Rule, under the Gramm-Leach-Bliley Act, sets what a mortgage lender’s or broker’s information security program must do (16 CFR 314.4). The program is the lender’s. Proxara, running in its own AWS or in a connected install, is one of the lender’s service providers, and this page goes element by element through what the rule asks of the data Proxara holds.
Element by element
| Requirement | Section | How Proxara meets it |
|---|---|---|
| Access controls | 314.4(c)(1) | Each officer sees only their own calls, signed in with a code sent to their work email; Proxara’s operators reach the data only to run and repair the service; in a connected install each of the lender’s systems is reached through one grant scoped to the officers. Access and logging |
| Know the data and systems | 314.4(c)(2) | Every part, what it holds and every connection, listed. Architecture, Every connection |
| Encryption | 314.4(c)(3) | TLS 1.2 or higher in transit, encrypted storage at rest, and each call’s record sealed again under AES-256. Encryption and keys |
| Secure development | 314.4(c)(4) | Each install’s release with a software bill of materials and a vulnerability check. Releases and updates |
| Multi-factor authentication | 314.4(c)(5) | The app signs in with a code sent to the officer’s work email, and asks Face ID before it shows a Social Security number or date of birth. In a connected install the officer signs in with the company’s Microsoft account, under the company’s own MFA. |
| Disposal | 314.4(c)(6) | No audio kept, the words of a call the officer doesn’t keep erased within 30 minutes, a Social Security number erased 14 days after the call, and anyone forgotten on request. A kept call stays until the officer deletes it. Retention and deletion |
| Change management | 314.4(c)(7) | A new version serves only once it answers its health check. |
| Monitoring and logging | 314.4(c)(8) | Each opening of a Social Security number and every change on Monday recorded; in a connected install every yes, write and message too; logs of identifiers and counts kept 30 days, or 90 in a connected install. |
| Overseeing service providers | 314.4(f) | The rule asks the lender to oversee Proxara and require these safeguards by contract. An officer can start the app with no contract between Proxara and the lender, so a lender that wants that oversight should ask for one. This Trust Center and the infrastructure code are open to the lender’s review. |
| Incident response | 314.4(h) | Proxara tells the officer, and the lender’s named security contact where there is one, without unreasonable delay once it discovers a breach of data it holds. Incident response |
| Notice to the FTC | 314.4(j) | Proxara’s notice comes early enough for the lender’s, within 30 days for an event involving 500 or more consumers. |
The rest of the program, the qualified individual, the risk assessment, training and the report to the board, stays with the lender. Proxara adds one service provider to it, and this Trust Center describes it for the lender’s risk assessment.
What Proxara holds and does not hold
Proxara does not hold a SOC 2 report yet. It holds the calls an officer keeps, their leads and the record of every change, as Retention and deletion lists. It holds no call audio and no credit vendor password, and it holds a whole Social Security number for no more than 14 days.