How we protect your book

Last reviewed: July 24, 2026

Your client list is the most valuable asset you own, and you're being asked to import it into software made by a company you just met. That deserves a straight answer, not a badge wall. Here's exactly how your data is protected.

The short version

Encrypted in transit and at rest, from the moment you import.
Isolated and encrypted to your account only. No other user can ever see your client list or data.
We never contact your clients. Your data is yours. We will never use your customer data to reach out to them for any reason, never market to them, and never sell or share your data.
Your data is always yours to take. Download a full copy anytime, and if you ever leave, we remove your client data completely.

Encryption

All traffic between you and RefiAgent uses TLS. Your data is encrypted at rest in the database. Card numbers never touch our systems at all. Billing runs entirely through a PCI DSS certified payment processor.

Where your data lives and who can see it

RefiAgent runs on enterprise grade cloud infrastructure that undergoes independent SOC 2 audits, the same class of infrastructure your bank's vendors run on. Those audits cover our infrastructure providers. Within that infrastructure, your data is scoped to your account: no other customer can see it, and it is never pooled or cross referenced with anyone else's.

Inside Bullhorn LLC, access to production data is limited to what's needed to run and support the service, and only when needed. If your brokerage needs vendor security documentation, ask us and we'll answer a security questionnaire honestly.

Our promises to you

We never contact your clientsYour client data exists for one purpose: briefing you. We will never use it to reach the people in it, by any channel, for any reason.

We never sell or share your dataNot to marketers, not to lenders, not to anyone. Your book is not a product and it never will be.

We never pull creditNo credit pulls and no reporting agency connections. Estimates come from your data plus public sources only.

Only you can see your bookYour data is isolated and encrypted to your account. No other user, ever.

Your controls

Take a copy anytime. Your full dataset is downloadable from your account whenever you want it.
Leave clean. If you cancel, your client data is removed from our live systems, and encrypted backups roll off automatically within 30 days. We keep backups only for redundancy and disaster recovery, never for reuse.

Found a vulnerability?

Tell us before you tell anyone else, and we'll take it seriously: michael@getrefiagent.com. We respond within 2 business days, and we won't pursue good faith researchers who report responsibly.

Questions we haven't answered

If your compliance team has a question this page doesn't cover, send it over. You'll get a specific answer from the person who built the system, not a canned reply.