Security & Compliance
Built for the vendor-risk questionnaire.
Bookend narrows the data-security scope by design: the software runs in your network, the model runs in your network, and the only thing that leaves is a heartbeat you can read on screen. Here is what your third-party risk, model-risk and audit teams will ask, answered.
Status
Where we are
Data handling
Loan data stays in the institution
No subprocessors for loan data
There are none. Documents, extracted terms, findings and the evidence chain live in your database and your document volume.
Outbound calls you can see
jXchange to your core, SMTP to your relay, the metering heartbeat. Each is configured in Settings and can be disabled; air-gapped mode is supported.
The heartbeat, verbatim
install id, version, period, closed-loan count, coarse health. Published in the questionnaire and shown on the Metering screen before it is sent.
Platform controls
What the software enforces
Identity
Password with Argon2id hashing or e-mail sign-in links; short-lived RS256 access tokens with rotating refresh tokens kept in memory, never in cookies; API keys with scopes for integrations; every sign-in, token and API-key use recorded.
Roles and segregation
Administrator, manager, closing specialist, boarding checker, auditor (read-only). The stager of a boarding or a wire can never be its approver — enforced, not procedural.
Secrets at rest
SMTP and core credentials and the signing key are encrypted with a master key you hold. Two database principals: an owner for migrations and a least-privilege account for the application.
Append-only evidence
The application account can insert evidence events but cannot update or delete them. Payloads are hashed in a canonical form and chained; a nightly sweep verifies every loan and alerts on a break.
Row-level audit
Business tables carry a change history through the data access layer; sign-ins, API keys and MCP calls are audited separately. Both are queryable in-product.
Rate limits and headers
Per-principal and per-address limits, login attempt limits, security headers and a content security policy on the UI; forwarded headers honoured only from your proxy network.
Model risk
SR 11-7, proportionate to a community bank
The extraction and classification model is inventoried by the bank. Bookend supplies the validation pack with every signed release: the test sets, accuracy by field type, known failure modes, monitoring guidance and the change history. Judgement is not in the model — it is in deterministic, versioned rules whose documentation ships in the product — and every loan is approved by a person.
Confidence gating routes low-confidence numeric and party fields to human review instead of auto-accepting them. The per-bank adaptation for your LAR format happens inside your deployment and never leaves it.
Change control
Signed releases, pulled by you
Releases are bundles: images, checksums, release notes, database migrations (forward-only, preflight-checked) and the validation pack. Your team verifies the signatures and applies the release in your maintenance window; Bookend never updates itself. The migrator refuses to run the application against a schema it does not recognise. Support covers the current and previous minor release.
Runbooks for install, upgrade, backup and restore, and incidents ship with the product, and a diagnostics screen gives support everything it needs without any loan data.
Send us your questionnaire
We answer vendor-risk and model-risk questionnaires in full. Ask for the security overview and the current validation pack.