Security and compliance are assumed.
Vision is designed under the expectation that its output will be reviewed by regulators, auditors, and compliance teams. We do not view security as a feature, but as a baseline for regulated operations.
Design Assumptions
Regulated environments.
Vision is built for brokerages operating under state and federal oversight. We assume audits will occur. We assume records will be questioned. We assume controls must be provable, not implied.
All brokerage data is treated as highly sensitive.
All outputs are subject to regulatory scrutiny.
All access must be attributable and auditable.
Data Ownership & Authority
System of Record
Your firm remains the system of record. Vision enforces logic but does not overwrite source systems. This ensures data integrity remains with the primary LOS or CRM.
Usage Boundaries
Zero data brokerage or resale. We maintain clear boundaries between data processing and data ownership. Your operational data is used solely to service your firm.
"The logic layer is ephemeral; the data remains yours. Vision is a processor, not an owner."
Technical Controls
Encryption
AES-256 encryption at rest. TLS 1.2+ encryption in transit across all network endpoints.
Access Control
Role-based access control (RBAC) utilizing least-privilege principles for all staff and systems.
Audit Logging
Immutable audit logs capturing all data access, system changes, and logic adjustments.
Environment
Strict segregation between production, staging, and development environments on AWS infrastructure.
Compliance Posture
Vision is designed to support regulated mortgage operations and align with SOC 2 principles. Our controls are implemented to support internal review, third-party validation, and audit readiness.
Audit in Progress: Institutional Certification 2026
For a detailed review of our security controls and architectural logic, request an operational assessment.