Vendor certification
for alternative finance.
Show brokers, funders, and merchants that your company protects the sensitive information they trust you with.
Our Mission
Secure Vendor™ recognizes technology and service providers that take steps to protect sensitive broker, funder, and merchant information, giving the businesses they serve a clearer signal about which vendors prioritize data protection.
Who can participate
Any technology or service provider that accesses, collects, processes, stores, or transmits sensitive information in alternative finance.
- CRMs and loan origination systems
- Broker and ISO portals
- Marketplaces and lead providers
- Bank statement and underwriting analytics
- Document collection and e-signature
- Data, verification, and AI providers
- Payment and servicing platforms
- Outsourced processing and support services
No checklist. A review built around your business.
Every vendor operates differently, so there’s no fixed questionnaire. We learn how your company handles sensitive information, then agree with you on what to review.
Secure Broker & Secure Funder
- Published technical requirements
- The same questions for every member
- A set list of acceptable safeguards
Secure Vendor
- Scoped to your operations
- Starts with a conversation
- Evidence that fits how you operate
The expectations are the same for every vendor: protect the sensitive information you’re trusted with. What varies is how you do it and the evidence that shows it.
Eligibility
- Registered business in good standing
- Company website
- Handles sensitive broker, funder, or merchant information in alternative finance
Next steps
- 01JoinMembership and directory listing.
- 02ScopeWe learn about your services, data flows, and safeguards.
- 03ReviewWe agree on the evidence needed and conduct your review.
- 04CertifyAssessment report, digital badge, and public announcement upon approval.
Membership does not guarantee certification.
Why certify
Earn trust faster
Show brokers and funders that you’ve taken documented steps to protect the information they share with you.
Support your customers
Help Secure Broker™ and Secure Funder™ members evaluate the safeguards of the vendors they rely on.
Stand apart
Demonstrate your commitment to protecting sensitive information through independent verification.
Shape the standard
Help establish practical data protection standards for vendors serving alternative finance.
Membership
Based on scope USD/year · monthly available
Payment not due to join.
- Scoping call
- Independent review
- Assessment report
- Member support and guidance
- Directory listing
- Digital badge upon certification
- Public announcement upon certification
- Industry and state compliance updates
- Participate in program development
- Distinguish your company
The membership fee covers the independent review, not its outcome. Membership does not guarantee certification.
Protect data. Earn trust.
Independent certification for the vendors alternative finance relies on.
Leadership
Data theft is an industry-wide problem. Progress starts with doing something about it.Christina Duncan, Program Director
FAQ
Common questions about Secure Vendor.
What is Secure Vendor?
An independent certification that recognizes technology and service providers taking steps to protect sensitive broker, funder, and merchant information in alternative finance. We don’t sell software or services, and Secure Broker and Secure Funder members aren’t required to use certified vendors.
What types of vendors can participate?
Any technology or service provider that accesses, collects, processes, stores, or transmits sensitive information in alternative finance. That includes:
- CRMs, loan origination systems, and broker or ISO portals
- Marketplaces and lead providers
- Bank statement and underwriting analytics
- Document collection and e-signature
- Data, verification, and AI providers
- Payment and servicing platforms
- Outsourced processing and support services
Not sure if you fit? Ask us.
Does certification guarantee that a vendor is secure?
No. Certification recognizes that a vendor has taken steps to protect sensitive information and that those safeguards were independently reviewed. It isn’t a guarantee of security, and it doesn’t replace your own due diligence when choosing a vendor.
Why aren’t there set requirements?
Because every vendor operates differently. A CRM, a lead provider, and an outsourced processing team handle information in very different ways, and a single questionnaire wouldn’t fit any of them well.
The expectations stay the same for every vendor: protect the sensitive information you’re trusted with. What varies is the safeguards you use and the evidence that shows them. We scope each review to your business and agree on it with you up front.
What do you look at?
It depends on your business. Common starting points include:
- How people sign in and how access is granted and removed
- Roles, permissions, and download controls
- Activity and audit logging
- How information is separated, retained, and deleted
- Whether information is shared, resold, or reused
- Third parties that touch sensitive information
Not every area applies, and we may add others that fit your business. See how it works.
Do you accept SOC 2 or ISO 27001 reports?
Yes, as supporting evidence. They aren’t required to participate, and they don’t determine certification on their own. We’ll focus the review on what they don’t cover, like how sensitive information moves through your business in alternative finance.
Do you need access to our code or systems?
No. Most evidence is screenshots, documentation, or a walkthrough of how you work. You can redact personal or proprietary information.
How long does it take?
It depends on scope. We’ll set a timeline together on the scoping call, and you can move at your own pace. Support is available throughout.
How does renewal work?
Certification renews annually. If your services or processes have changed in ways that affect sensitive information, you report the changes for review. If nothing has changed, you confirm that, and payment renews automatically.
Are refunds available?
No refunds are available once the review has begun, regardless of the outcome.
Can certification be revoked?
Yes, if the safeguards reviewed are no longer maintained or information provided during the review is found to be inaccurate. If certification is revoked or lapses, the badge and any mention of certified status must be removed.