How Verification Works

Live Screen Share

Google Meet invitation

15–30 Minutes

Quick and effective

Not Recorded

Your information is confidential

Our Approach

  • You share your screen — we never access your systems directly
  • You only show what's necessary to verify each control
  • Pause or reschedule anytime — including disabling screen share between requirements
  • Our goal is to work with you to achieve certification
Example Verifications

These are a few examples to give you a general idea of what verification looks like. The full list of requirements is available on the Requirements page.

Multi-Factor Authentication

Verifying MFA is enabled for email and CRM access.

What We Ask

Log out of your email and CRM, then log back in while sharing your screen. We'll confirm that MFA is prompted during the login process.

Email Submission Handling

Verifying how broker submissions via email are processed.

If Automated Processing

We'll send a test submission in real time to confirm it gets added to your CRM without human intervention.

If No Email Submissions

We'll ask to see a copy of your ISO guidelines or broker documentation confirming that portal and/or API are the only accepted submission methods.

If Using Email Watermarking

We'll verify it in real time by sending a test submission and confirming attachments are watermarked upon arrival.

Role-Based Access Controls

Verifying that sensitive information is only visible to those with business necessity.

What We Ask

As an admin, log in as users in various roles to demonstrate that sensitive information (SSN, DOB, etc.) is only visible to those who need it for their job function.

For documents: Show that files are either view-only, or if downloadable, they're already watermarked or get watermarked at time of download.

User Verification

Confirming that system access is limited to appropriate personnel.

What We Ask

A quick scroll through your user list. We're confirming no external entities have access—particularly brokerages, software platforms, or other lending companies—even if under common ownership.

If related entities do have access: We'll discuss the business rationale and determine if it meets the intent of the requirement.