Your statements are the
most sensitive thing
you will send us.
So here is exactly how they are encrypted, who can open them, and the rules that govern how we contact you. In plain English, with no certifications we have not earned.
Encrypted on the way here,
and once it lands.
HTTPS encryption
Our public website uses HTTPS. Strict Transport Security requests HTTPS-only connections for two years after a supported browser receives the header. Applications and uploads take place on our separate CRM domain.
AES-256 on stored documents
Statements and application data are encrypted at rest in the document store and the database. Keys are managed by the platform and never held in application code.
Hardened response headers
Our public website disables content-type sniffing, restricts framing to the same origin, limits cross-site referrers to the origin, and requests that supported browsers disable camera, microphone and geolocation access.
A bank statement should not be
one forward away from anyone.
Every download re-checks who is asking
Documents are served through an authenticated route that verifies the session on every request. Nothing is linked to directly from a page or an email.
Scoped to the people on your file
Access is checked against the specific deal a document belongs to. Someone not assigned to your file does not get to open your statements.
Your pages stay out of search engines
Upload, confirmation and returning-merchant pages carry noindex directives, so nothing tied to your file is crawled.
Submitted once, not to a mailing list
Statements go to the underwriter on your file and, where one is used, the one funder reviewing it. Never to marketing partners, never to build a lead list.
Two-factor on every login.
No exceptions, no roles that skip it.
Every Apex team member, underwriter, rep or admin, clears a one-time code on top of their password at every sign-in. Codes expire in minutes, so a stolen password on its own opens nothing.
Public forms and internal routes are rate-limited per address to blunt scraping and credential stuffing, and administrative pages are served no-store and blocked from every crawler.
Protections that run before
a message ever leaves.
Applying for capital should not put you on a call list. Every outbound message clears the same gate, and one that fails it is held or dropped, not sent anyway.
- 01Federal Do Not Call is checked before we dial
- Every number is screened against the registry before outbound contact. If the check cannot complete, the call is held rather than pushed through.
- 02No cold texts, by construction
- We never send a first text to someone who has not said yes. A text only ever follows something you already answered, and a STOP on any channel revokes every channel.
- 03No 3am messages
- Outbound messages are gated to civil hours in your own time zone, judged by your area code. One that comes due overnight waits for morning.
- 04Frequency caps
- Pacing limits cap how much outbound contact any one number can receive, so nothing can stack messages on you.
- 05No invented terms in a text
- Automated messages are screened for offer details. Amounts and terms come from a named underwriter on a real file, in writing, never from a blast.
The short list
that matters most.
- No fee to apply, and no fee to see your terms
- No hard credit pull to get an offer
- No selling, renting or sharing your application with lead brokers
- No automated message that quotes you a rate, an amount or a term
- No contact after you ask us to stop
- No second position on a business that cannot carry it
Found something? Tell us directly.
If you believe you have found a vulnerability, received a message you never opted into, or seen a document link that should not have worked, write to us and it goes to a person, not a queue. We do not pursue anyone acting in good faith who reports a problem to us first.
This page describes our current practices and is not a warranty or a contractual commitment. See the privacy policy for how information is collected and used.
Send statements securely.
Encrypted upload, encrypted storage, and a named underwriter on the other end.