One page for your compliance contact
| Topic | Answer |
|---|---|
| What the tool does | Collects photos and documents from an office’s clients through a per-request link; the office downloads them and files or uploads them where they belong. No carrier, lender or LOS integration. |
| Data held | Client contact and language information; requested documents, including identity and financial records; typed answers, questions and request history. Authentication, delivery and operational records are also held. |
| Isolation | Forced per-agency PostgreSQL row-level security and user-scoped agent queries, covered by local isolation tests. Agent access uses emailed codes and optional passkeys. Mandatory policy is built but not activated; production roles and rollout remain unverified. |
| Encryption | Private-storage and same-origin download architecture is implemented. Actual deployed encryption, transport minimums, region and provider access settings are unverified; no end-to-end encryption claim. |
| Retention | Ordinary files: 13 months after closure by default, configurable 1–120. Marked sensitive files: 60 days, configurable 7–400. Sensitive deletion blocks affected complete zips; retained individual files remain available. Backup/lifecycle deadlines and other record schedules require production verification. Closure is not last use. |
| Subprocessors | Render (servers/PostgreSQL), AWS (S3 files/backups), Postmark (email), Anthropic (agent-text translation only), Apple (staff phone notifications: client and checklist names only), Stripe (hosted billing when enabled). Actual locations, contracts and enabled services are unverified. |
| Sharing | Provider processing is limited by application purpose. Client files and answers are not sent for translation or AI document processing. Contractual data-use terms and operational settings remain unverified. |
| Certifications | Gathered Docs itself is not yet audited. No application SOC 2 or GLBA certification is claimed; provider audit reports have not been verified by this review. |
| Known limitations | A borrower link is a bearer credential, not independent identity verification or MFA. Mandatory staff passkeys, stable-domain/native compatibility, full retention inventory and production safeguards still require readiness approval. |
| Contact | luis@snapdiscountdocs.com · Gathered Docs is operated by Aced LLC (Luis Ramirez), 1666 E Sunshine Street, Springfield, MO 65804 |
Unverified: deployed encryption and TLS, storage regions and private access, versioning, backup health, deletion timing and a restore/deletion rehearsal.
Unverified: named operator/deputy coverage, provider MFA and least privilege, access logging, credential-rotation and incident-response drills.
Unverified: current provider agreements, complete data-retention schedules and exceptions, legally reviewed DPA/incident terms and the agency compliance owner’s acceptance.