Services built for mortgage brokers.
Everything we do starts with one question: what does a small brokerage actually need to pass its next exam and stay secure — and what can it skip?
New York 23 NYCRR 500 Documentation Package
The complete written program a New York mortgage broker needs for DFS — built from your actual Microsoft 365 configuration, drafted with agentic AI, and reviewed by a Microsoft expert before it reaches you.
If you qualify for the small-business exemption, the package is sized to match: no penetration test, no CISO, no 200-page policy binder. Just what the regulation requires, done right.
Outside New York? The FTC Safeguards Rule (16 CFR Part 314) requires mortgage brokers in every state to maintain a written information security program. It has its own small-business exception for firms holding information on fewer than 5,000 consumers. We build to it as well.
- Exemption check — do you qualify under 500.19(a)?
- Cybersecurity program and written policies (500.2, 500.3)
- Risk assessment (500.9)
- Asset inventory and data disposal policy (500.13)
- Access privilege review and offboarding procedure (500.7)
- Third-party service provider policy (500.11)
- MFA configuration and evidence (500.12)
- Awareness training records (500.14(a)(3))
- 72-hour incident notification procedure (500.17(a))
- Notice of Exemption and April 15 filing support (500.19(f), 500.17(b))
What else we do for brokers
Every service is scoped up front, reviewed by a person, and built around the Microsoft tenant at the heart of your business.
Risk Assessments
The foundation of everything else. A structured, documented look at your systems, vendors and data, mapped to 23 NYCRR 500 — and to the FTC Safeguards Rule outside New York.
If you qualify for the small-business exemption, we document exactly what it covers, so an examiner can see you applied it correctly.
- Control-by-control review against the regulation
- Microsoft 365 tenant configuration review
- Vendor and data-flow mapping
- A prioritized remediation roadmap in plain English
- Annual refresh, and updates after material changes
Microsoft 365 Security Hardening
Most brokerages run on Microsoft 365 configured the way it came out of the box. We turn on the protections you're already paying for and document every change for your compliance file.
Microsoft renames and reshuffles its security features constantly. Keeping up with that is exactly the work AI agents are good at — and every change is reviewed by a person before it touches your tenant.
- MFA and Conditional Access that meet 500.12
- Anti-phishing and email authentication (SPF, DKIM, DMARC)
- Device management and encryption with Intune
- Least-privilege admin roles and break-glass accounts
- Secure Score improvements with before-and-after evidence
Onboarding & Offboarding Procedures
Access reviews are required even for exempt brokers — and the riskiest day for your data is the day someone leaves. We build the process and the paper trail.
Our co-founders have run onboarding and offboarding inside mortgage companies. We know where the gaps are: the shared mailbox nobody removed, the vendor portal nobody remembered.
- Documented onboarding and offboarding runbooks
- Same-day access removal across Microsoft 365 and key apps
- Access review sign-off records for 500.7
- License and shared-mailbox cleanup
Examiner & Auditor Support
We've sat across the table from state examiners and explained modern Microsoft cloud controls in terms they recognize. When your exam comes, you don't walk in alone.
We prepare your document responses, walk examiners through how your controls actually work, and help you close out any findings.
- Exam preparation and document request responses
- Walkthroughs of your Microsoft 365 controls
- Remediation tracking after findings
- Notice of Exemption and April 15 filing support
Technology Stack & IT Spend Review
AI agents now handle work that used to require human helpdesk staff. If your IT bill looks the same as it did in 2023, it's worth a second look.
We review everything you pay for — your IT provider, your Microsoft licenses, your software subscriptions — and show you where the money should go now.
- Microsoft license right-sizing
- Managed services contract review
- Overlapping tools and unused subscriptions
- A clear recommendation you can act on
Vendor Selection & Negotiation
Having worked for SaaS companies that serve the mortgage industry, we know how vendors decide what their services are worth — and where there's room to negotiate.
We help you find the right tools to do more loans, and help the small shop get big-shop value from its vendors.
- Tool selection matched to how you originate
- Contract and renewal review
- Vendor security due diligence (supports 500.11)
- Negotiation support
Custom AI Automation
Agentic AI can build custom tools and automations that save hours per employee, per day — built on your Microsoft tenant, reviewed by a human, and documented for your compliance file.
- Workflow automation inside Microsoft 365
- Custom internal tools
- Secure document collection
- Every automation documented for your risk assessment
Not sure where to start?
Most brokers start with a risk assessment and an exemption check. It tells you where you stand and what to fix first.