How is sensitive borrower financial data like income, credit score, and partial SSN protected?

For Mortgage Brokers

Mortgage brokers are financial institutions under the Gramm-Leach-Bliley Act (GLBA), which means nonpublic personal financial information collected from borrowers, income, credit score ranges, employment details, and any account or identifying numbers volunteered during intake, has to be safeguarded with the same care your LOS and CRM already apply. Voksha encrypts call data in transit and at rest, and qualification data collected during a call flows only into your connected systems (your LOS, whether Encompass, Calyx Point, or BytePro, and your CRM, whether that's Surefire, Salesforce, or HubSpot), not shared or resold to third parties. A practical setup note: the qualification script should be built to capture ranges and categories rather than exact sensitive numbers where possible, credit score bands instead of a pulled credit report number, income ranges instead of exact pay stub figures, and it should never ask for a full Social Security number over an unverified inbound call, since that data belongs in your secure loan application process once the borrower is verified and working with a licensed LO, not in initial phone intake. If a caller volunteers a full SSN unprompted, that data still needs to be handled under your existing GLBA safeguards program the same as any other channel. The Enterprise plan includes GDPR compliance documentation, which becomes relevant if your brokerage originates for borrowers with EU residency or works with international correspondent lending partners who require it as part of vendor security review. Most brokerages reference the Enterprise plan specifically when a wholesale or correspondent partner sends a vendor security questionnaire.