GLBA Compliance Statement

Margie — Pre-Underwriting Analysis Platform

Effective Date: March 22, 2026

Last Updated: October 25, 2026

1. Purpose and Scope

This GLBA Compliance Statement describes the safeguards Margie (“we,” “us,” “our”), operating the pre-underwriting analysis platform at getmargie.com (the “Platform”), applies to nonpublic personal information under the Gramm-Leach-Bliley Act (“GLBA”), 15 U.S.C. §§ 6801–6809, and its implementing regulations, including the FTC Safeguards Rule (16 C.F.R. Part 314) as amended.

Margie operates as a service provider to licensed Illinois mortgage brokers. In this capacity, we receive, process, and store nonpublic personal information (“NPI”) of mortgage loan applicants (borrowers) on behalf of our broker clients. This statement documents our information security program, safeguards, and compliance measures.

2. GLBA Applicability to Margie

2.1 Regulatory Framework

The GLBA requires financial institutions to protect the security and confidentiality of customers' NPI. Whether Margie is itself a financial institution under the GLBA is under review with counsel. Margie processes NPI on behalf of financial institutions (licensed mortgage brokers) and maintains safeguards consistent with the GLBA's requirements.

Under the FTC Safeguards Rule, 16 C.F.R. § 314.4(f), a financial institution must oversee its service providers: select ones capable of maintaining appropriate safeguards for the customer information at issue, require them by contract to implement and maintain those safeguards, and assess them periodically. Our broker clients therefore must ensure that their service providers — including Margie — maintain adequate protections. This statement documents how we meet those obligations.

2.2 Categories of NPI Processed

The Platform processes the following categories of NPI contained in borrower documents:

• Identifying information: Names, addresses, dates of birth, Social Security numbers, and government-issued identification (driver's license or state ID details)
• Employment information: Employer names, addresses, positions, income, and employment history
• Financial account information: Bank account numbers, account balances, transaction histories
• Tax information: Tax returns (Form 1040 and its schedules), Forms W-2, 1099, 1098 and SSA-1099, and withholding amounts
• Credit and loan information: Loan application details, asset and liability disclosures, property information, and credit scores entered by the broker
• Other 1003 application data: Demographic information, housing history, declarations

3. Information Security Program

Margie maintains a written information security program to protect the confidentiality, integrity, and availability of NPI, structured on the elements of the FTC Safeguards Rule (16 C.F.R. § 314.4). Its current version was adopted by our designated qualified individual on October 4, 2026. This section describes the program's structure and states, for each element, what is in place today.

3.1 Designated Qualified Individual

In accordance with 16 C.F.R. § 314.4(a), Margie has designated a qualified individual responsible for overseeing, implementing, and enforcing the information security program. Margie is a sole proprietorship with no employees; its founder and owner serves in this capacity. The designated individual is responsible for reviewing the program at least annually and for documenting material security events.

3.2 Risk Assessment

Margie's first written risk assessment, identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of NPI and assessing the sufficiency of existing safeguards, was first made on September 27, 2026 and is part of the adopted program. It will be repeated at least annually and whenever material changes are made to the Platform's architecture or third-party service providers.

3.3 Safeguard Design and Implementation

The safeguards in place today are described in Sections 4 through 8. Testing today consists of an automated test suite run on every change pushed to the Platform's code, and weekly automated proposals of dependency updates. Independent penetration testing and vulnerability assessments have not yet been performed; they are scheduled in the program's action plan.

4. Technical Safeguards

4.1 In-Memory Processing Architecture

Margie's most significant technical safeguard is its in-memory-only document processing architecture:

• No persistent document storage. Margie does not write original documents or document images to disk, file storage, cloud object storage, or any other persistent medium.
• Memory only, and only during the analysis. Document data is held in server memory while the analysis runs; the results extracted from documents are kept in memory between the stages of one analysis for at most 30 minutes. What each stage read from them is also saved, with no page text, beside that stage's result, so the stage can be re-run later without the documents. Azure Document Intelligence keeps its own copy for 24 hours (Section 5.3).
• Reduced attack surface. Because Margie never stores original documents, a breach of Margie's database, its backups, or its storage cannot expose them.
• What is stored. In Azure Cosmos DB, encrypted by Margie (AES-256-GCM): every analysis result, note and review; the borrower details read from documents (names, addresses, employers, property and loan figures, incomes, assets, credit score and ratios); the session list; every saved version; and each value a broker confirms, withdraws or cannot confirm on a file, with who, when, the document and page it is printed on, and what Margie had read. Beside each stage's result, the reads that stage used, so it can be re-run later without the documents: the figures, names, dates and lines read from them, among them a pay stub's deduction lines with their amounts and the fraud screen's short quoted matches (a few characters of a document either side of each); never a page of a document's text, and with Social Security, account and identification numbers and dates of birth masked. They are deleted with the analysis. Left readable, so the database can find a record and check who may open it: record, user and brokerage ids, dates and times, how many stages ran, and document types. The audit log is encrypted the same way: what stays readable is whose entry it is, which analysis it belongs to, the kind of event, its stage and time, and its place in the chain.

Even in the event of a full database compromise, an attacker would not gain access to original borrower documents, nor, without Margie's encryption key, to the borrower details of any analysis; they would see the fields left readable, listed above.

4.2 Encryption

• In transit: All data transmitted between users' browsers, Margie's servers, and third-party services is encrypted using TLS 1.2 or higher with strong cipher suites.
• At rest: Everything stored in Azure Cosmos DB is encrypted at rest by Microsoft (AES-256). In addition, Margie encrypts (AES-256-GCM) every stored field of an analysis that could identify or describe the borrower, leaving readable only what the database needs to find and authorize a record, in the analyses and the audit log alike.
• Third-party transmission: Data sent to Azure Document Intelligence and Azure OpenAI is transmitted exclusively over encrypted channels.

4.3 Access Controls

• Authentication: User authentication is managed through Microsoft Entra External ID (CIAM) using the OAuth 2.0 authorization code flow with PKCE. Server-side sessions are independently signed and validated on every request.
• Production access: Access to production infrastructure, databases, and third-party service configurations is limited to the founder.
• User data isolation: Each broker's analysis results are logically isolated in Azure Cosmos DB, and API routes verify ownership and organization membership before returning any loan data. Brokers cannot access other brokers' data.
• API key management: Third-party API keys and the Platform's own secrets are held in Azure Key Vault, not in source code or application configuration files. Azure OpenAI is reached with the Platform's managed identity, and key access is turned off on that resource, so no key for it exists.

4.4 Rate Limiting and Abuse Prevention

The Platform enforces sliding-window request rate limits on API endpoints and authentication actions, keyed per endpoint and per client where the client's address is available, to prevent brute-force attacks, credential stuffing, and platform abuse. Rate limits are configured to permit normal business use while blocking automated attack patterns. Limits are held per server process.

4.5 Monitoring and Logging

• Error monitoring: The Platform's error-monitoring instrumentation is configured with data-scrubbing controls — a denylist of NPI field names with recursive redaction, plus pattern-based scrubbing of SSNs, EINs, account numbers, and dates — designed to prevent borrower NPI from appearing in error payloads.
• Audit logging: The Platform records analysis steps, document uploads, reviewer overrides of findings, values a broker confirms, withdraws or cannot confirm (with the document and page, and what Margie had read), each re-run of the stages with those confirmations, and file opens, each with the user and time, in audit logs stored alongside platform data in Azure Cosmos DB. Entries cannot be changed through the Platform; a correction is added as a new entry that names the one it corrects. Each entry is chained to the one before it with a keyed hash whose key is held separately from the database, so a change or deletion made directly in the database shows as a break when the log is checked. The check cannot reveal a change made by someone holding both the database key and the separately held key, and entries written before September 29, 2026 are not chained. Report downloads are not recorded. Sign-in events are recorded by Microsoft Entra External ID in its own sign-in logs, not in Margie's audit logs.
• Alerting: An Azure alert rule watches the Platform's server errors, and an Azure Application Insights Failure Anomalies alert notifies the qualified individual by email when the rate of failed requests to the Platform rises abnormally. Microsoft Defender for Cloud threat protection is enabled for the Platform's Azure Cosmos DB database and raises security alerts on potentially harmful access to it. Automated alerting on unusual sign-in, processing-volume, or API-usage patterns is not yet configured.

5. Third-Party Service Provider Oversight

5.1 Due Diligence

We choose providers that publish recognized security certifications (such as SOC 2 Type II or ISO 27001); copies of their reports are being collected.

5.2 Contractual Safeguards

Each third-party provider that processes NPI does so under its published data processing terms, and we keep a dated copy of each provider's data processing addendum: Microsoft, Stripe, and Resend. The list is available to broker clients on request. These terms require the provider to:

• Implement and maintain appropriate safeguards for NPI
• Use NPI only for the purposes of providing services to Margie
• Limit retention as stated in each provider's terms (Section 5.3)
• Notify Margie of any security incidents that may affect NPI
• Permit reasonable security assessments or provide evidence of compliance

5.3 Provider-Specific Safeguards

Microsoft Azure (Cosmos DB, Entra External ID, Document Intelligence, Azure OpenAI): Margie's core infrastructure provider. Encrypted analysis results are stored in Azure Cosmos DB; user identity is managed through Microsoft Entra External ID; and document OCR is performed by Azure Document Intelligence, which receives documents over encrypted channels. Microsoft states that Document Intelligence stores the submitted documents and analysis results for 24 hours after an analysis completes and then deletes both automatically (Microsoft Learn, “Data, privacy, and security for Document Intelligence,” July 22, 2026). Margie's notes, the stage notes, Stage 6's plain-language explanation, the borrowers' names at intake and any field the typed models could not read are produced by Azure OpenAI in Margie's own Azure account, in a Data Zone deployment in the United States, from each stage's results and the text read from the documents, masked first; gpt-6-luna answers every call and gpt-6-sol, in the same account under the same terms, is the standby. Microsoft states that prompts and completions are not available to OpenAI and are not used to train any generative AI foundation model without the customer's permission or instruction, and that prompts and completions its abuse monitoring flags may be stored in the resource's geography for review by authorized Microsoft employees; no period is stated (Microsoft Learn, “Data, privacy, and security for Foundry Models sold by Azure in Microsoft Foundry,” May 18, 2026). Microsoft processes this data under the Microsoft Products and Services Data Protection Addendum (May 22, 2026).

Stripe: Payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. Margie does not store full payment card numbers. Stripe processes billing data in accordance with PCI DSS requirements.

6. Incident Response

6.1 Incident Response Plan

Margie maintains a written incident response plan for detecting, responding to, and recovering from security events that may compromise NPI, as part of its information security program. It covers:

• Detection and classification: Procedures for identifying and classifying security incidents by severity
• Containment: Immediate steps to contain the scope of an incident and prevent further exposure
• Investigation: Procedures for determining the cause, scope, and impact of an incident
• Notification: Protocols for notifying affected broker clients, borrowers (where required), and regulators in accordance with applicable breach notification laws, including the Illinois Personal Information Protection Act (815 ILCS 530)
• Remediation: Steps to address the root cause and prevent recurrence
• Documentation: Requirements for documenting incidents and response actions

6.2 Notification Obligations

In the event of a security incident involving unauthorized access to NPI, we will:

• Notify affected broker clients immediately following discovery, as the Illinois Personal Information Protection Act requires of a service that holds information it does not own (815 ILCS 530/10(b)), giving the date or approximate date of the breach, its nature, and the steps we have taken or plan to take
• Cooperate with broker clients in their own notification and regulatory reporting obligations: broker clients notify affected Illinois residents, and the Illinois Attorney General where required, unless counsel advises that Margie must notify them itself

7. Data Minimization and Retention

7.1 Data Minimization

Consistent with the GLBA's principles and the FTC Safeguards Rule, we minimize the collection and retention of NPI:

• Document layer: Original borrower documents are not retained by Margie. They are held in server memory while the analysis runs; extracted results for at most 30 minutes, and the reads each stage used are saved with its result, with no page text (Section 4.1).
• Results layer: Only structured analysis results necessary for the service are stored. These results contain derived findings, not full reproductions of original documents.
• Operational data: Technical and usage data collected for operational purposes is limited to what is necessary for security, performance monitoring, and billing.

7.2 Retention Schedule

Two consequences of the above are stated explicitly rather than left implied:

• No usage history survives termination. Monthly analysis counters are stored on the organization record itself, not in a separate ledger. When that record is deleted with its administrator's account, the counters are destroyed with it. The record of the closure keeps only how many records of each kind were deleted, not how many analyses were run.
• Termination resets the monthly analysis limit. Because the counter lives on the organization record, terminating an account and creating a new one begins a fresh monthly allowance. Account creation is administrator-approved rather than self-service, so this is not an open path to exceeding the limit today. It would require revisiting if self-service signup is introduced.

7.3 Disposal

When NPI is no longer needed, it is disposed of securely:

• In-memory data: Released when the analysis completes; extracted results are kept in memory for at most 30 minutes
• One analysis: When an analysis is deleted from its session page, its results, notes, the reads saved to re-run its stages, document and version records, feedback and audit-log entries are removed at once, and a record of the deletion, naming the analysis by its id and holding no borrower details, is added to the brokerage's audit log
• Account data: When an account is closed, a cascade deletion removes the loans the account created, their document records, analysis versions, sessions and audit entries from Azure Cosmos DB: at once when the user closes the account in the account settings, and within 30 days when it is closed at the user's request or because we terminate it. What remains is the record of the closure itself, which identifies the user only by an internal user ID, and the audit entries described in the retention table above. Copies in the database's automatic backups remain until those backups expire
• Logs and metadata: Removed as part of account deletion, except the audit entries described in the retention table above

8. Employee Training and Access

8.1 Personnel Security

Margie currently operates as a solo-founded startup. System access to production infrastructure, databases, and third-party service configurations is limited exclusively to the founder.

8.2 Background Checks

As the team grows, all personnel granted access to systems that process or store NPI will be required to:

• Complete security awareness training upon onboarding and annually thereafter
• Acknowledge and comply with Margie's information security policies
• Use multi-factor authentication for access to production systems
• Follow the principle of least privilege for system access
• Submit to appropriate background checks, to the extent permitted by applicable law

9. Program Evaluation and Reporting

9.1 Ongoing Monitoring

Monitoring today consists of:

• An automated test suite run on every change pushed to the Platform's code
• Weekly automated proposals of dependency updates
• Error telemetry in Azure Application Insights, with personal information scrubbed before it is sent
• An Azure alert rule on the Platform's server errors
• An Application Insights Failure Anomalies alert, emailed to the qualified individual, when the rate of failed requests rises abnormally
• Microsoft Defender for Cloud threat protection for the Azure Cosmos DB database

Continuous monitoring of the Platform as a whole, scheduled review of access logs, penetration testing, and vulnerability assessments are not yet in place; they are scheduled in the program's action plan.

9.2 Annual Review

The information security program will be reviewed at least annually, and updated as necessary to address:

• Changes in the Platform's technology architecture
• New or evolving threats to NPI
• Changes in applicable laws, regulations, or regulatory guidance
• Findings from risk assessments, audits, or security incidents
• Changes in third-party service providers or their security posture

9.3 Reporting

The designated qualified individual will provide a written report at least annually, covering:

• The overall status of the information security program
• Material security events and incidents during the reporting period
• Results of risk assessments and testing
• Recommendations for program improvements

10. Cooperation with Broker Clients

10.1 Due Diligence Support

We recognize that our broker clients have their own GLBA compliance obligations, including oversight of their service providers. We will cooperate with reasonable due diligence requests from broker clients, including:

• Providing documentation of our security practices and safeguards
• Responding to security questionnaires
• Providing evidence of third-party security certifications where available
• Making this GLBA Compliance Statement available for review by brokers and their regulators

10.2 Regulatory Cooperation

In the event of a regulatory examination or inquiry concerning a broker client's use of Margie, we will cooperate with the broker and their regulator to the extent required by law, including providing information about our data processing practices and safeguards.

11. Regulatory References

This compliance statement is informed by and designed to satisfy the requirements of:

• Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809
• FTC Safeguards Rule, 16 C.F.R. Part 314 (as amended Dec. 9, 2021, and at 88 FR 77508, Nov. 13, 2023)
• Privacy of Consumer Financial Information (Regulation P), 12 C.F.R. Part 1016
• Illinois Personal Information Protection Act, 815 ILCS 530
• Illinois Residential Mortgage License Act, 205 ILCS 635

12. Contact Information

For questions regarding this GLBA Compliance Statement or Margie's information security program, contact:

Margie
Email: contact@getmargie.com
Website: getmargie.com