Security

Everything below is a description of how the system works rather than a statement of intent. Where we have not done a thing, this page does not say we have.

Applying never touches your credit score

There is no hard credit check when you apply. Anything we show you before an underwriter has read the file is indicative, and every screen that shows a number says so.

Your documents are not public, and are not served from a bucket

Bank statements and paperwork are held in private object storage. Nothing is ever served from that storage directly: every read goes through our application, which checks who is asking and then issues a link that expires. A URL to one of your documents is no use to anybody who is not signed in as someone entitled to it.

We never see your ID

The identity check is run by our identity provider in a window our application does not get to read. The photograph of your licence and the liveness check never reach Spark; what comes back to us is a decision.

Who inside the business can see what

Access is decided on the server for every page, not in the browser. Roles cannot be self-assigned — a public sign-up can only ever create a borrower account, and staff accounts are created by an administrator. Internal notes on an application are stripped from what a borrower is shown, in the query rather than in the page, and the sensitive underwriting file is kept from staff who do not need it by not being selected at all.

Your team sees your business, and nothing else

An application belongs to a business rather than to a person, so the people you invite can work on it. They see that business's applications and no others. Only an owner can send an application in or invite anybody else, and an invitation belongs to the address it was sent to — forwarding one does not work. Owners and employees sets out the difference.

Passwords, and staying signed in

A password needs at least eight characters, an uppercase letter, a lowercase letter, a number and a special character — and the same five rules are enforced on every path that sets one, including a reset and an invitation. A reset link lasts an hour and works once. Sessions last thirty days and are per device, so signing out of a shared laptop does not sign you out of your phone.

The browser protections

Both the site and the application are served over HTTPS with HSTS for two years including subdomains, refuse to be framed by anybody (frame-ancestors 'none'), decline MIME sniffing, and send only the origin — never the full path — as a referrer to other sites, so an application id never travels in somebody else's logs.

What we do with your data

It is used to underwrite your application and arrange your financing. Applying authorises us to share the application and its documents with the lenders who might fund it — that is what a brokerage does, and the permission is recorded against each application separately with the time it was given. We do not sell it. The privacy policy is the long version.

Leaving

You can close your account yourself, from the app, and it asks for your password because it cannot be undone. It deletes your details, your password, every signed-in device, and any application you never sent — including the documents on it, removed from storage as well as from the database. Applications you did send are kept against the business, with your personal details removed, because we have to be able to answer for a file we underwrote. Closing your account walks through it.