Findlan now has a SOC 2® Type 1 report on the controls behind its construction loan administration services, issued by Securance Pro Assurance PLLC, an independent CPA firm. The report describes Findlan's system as of October 1, 2026, and covers Drawserv, the platform lenders use to administer their construction loans, together with the people, procedures, and hosting that run it. It was prepared against the AICPA Trust Services Criteria for Security, Confidentiality, and Availability.
Why it matters to a lender
When a lender hands draw administration to a third party, that third party becomes part of the lender's own control environment. Examiners and internal audit ask the same questions of us that they ask of any critical vendor: who can see borrower and project data, how access is granted and removed, how changes reach production, and what happens when something fails. A SOC 2 Type 1 report answers those questions in the format vendor-management teams already use, so a lender's due diligence on Findlan can move from a questionnaire to a document on file.
What the report covers
- Security. Role-based access to the platform and its infrastructure, with quarterly access reviews and same-day removal when someone leaves. Every change reaches production through code review, automated security scanning, and a recorded release approval. Regular vulnerability scanning and an incident response plan.
- Confidentiality. Customer data encrypted in transit and at rest, confidentiality agreements with everyone who works with it, and a data classification policy that restricts customer data to the purposes in our agreements.
- Availability. External monitoring of the platform and its components, with a public status page; daily encrypted backups with point-in-time recovery and a tested restore procedure.
The report also sets out the controls Findlan relies on from its hosting providers and the complementary controls expected of lenders using the platform.
A Type 1 report describes the controls in place and their design as of the report date. It is a point-in-time examination, not a certification.
Getting the report
SOC 2 reports are restricted-use documents, so we do not publish it. Lenders and prospective lenders working through vendor due diligence can ask their Findlan contact for a copy. The Trust Center carries the current security overview, and the status page reports platform availability.