How Surecase keeps data secure

A mortgage application needs some of the most sensitive documents a person owns: passports, bank statements and payslips. Surecase is built to protect them. This page explains how.

Why documents are needed

Mortgage lenders must confirm who a borrower is and that they can afford the loan. Money laundering rules also require advisers to check each client’s identity. Surecase gives advisers and clients a secure place to exchange these documents.

Safer than email

Email was not designed for sensitive documents. A message can pass through several unknown servers on its way, and some of them may not encrypt it. Once it arrives, the attachment can stay in inboxes, sent folders and backups for years.

A document uploaded to Surecase goes directly into encrypted storage over a secure connection. No copy is left in anyone’s inbox.

Data stays in the UK

Surecase runs on Amazon Web Services (AWS) in its London region. Cases, client records and documents are stored in the UK. A small number of services, such as sign-in and automated document checks, run within the EU under the same data protection standards.

Encrypted at every step

All traffic to and from Surecase is encrypted with TLS 1.2 or higher. Documents and the database are also encrypted at rest. Data is protected while it moves and while it is stored.

Two-factor sign-in for everyone

Sign-in is handled by Auth0, a specialist identity provider. Two-factor authentication is mandatory for every account, for advisers and clients alike. As well as a password, each person uses a text message, a phone call, an authenticator app or a hardware security key. A stolen password alone cannot open an account. Inactive sessions are signed out automatically.

If a client changes or loses their phone, their adviser can reset their two-factor sign-in.

The right people see the right data

Each firm’s data is kept separate, and no firm can see another firm’s cases or clients.

Within a firm, access depends on each person’s role. For example, an assistant can be limited to the cases of specific advisers. Clients see only their own case, and only the documents their adviser shares with them.

Signatures stay inside Surecase

Digital signing runs on Surecase’s own infrastructure. Documents sent for signature are not passed to a third-party e-signature service.

Automatic document checks

A delay often starts with a simple mistake, such as the wrong document uploaded or a name that does not match the client. To catch these early, Surecase checks uploaded documents automatically and flags anything that looks wrong. The adviser then decides what to do.

These checks use an AI model, but not in the way most people expect. Documents are never sent to AI companies or public AI tools such as ChatGPT. The model runs privately inside Surecase’s own Amazon Web Services environment, within the EU. The company that built the model has no access to it and cannot see any document.

Documents are never used to train AI models.

A full audit trail

Surecase records key actions, such as sign-ins, document uploads, downloads and deletions, and changes to security settings. If a question comes up about what happened on a case, the record can be checked.

Backed up and monitored

Data is backed up automatically and can be restored to any point in the last 35 days. Our systems are monitored around the clock, and errors alert our engineering team straight away.

Tested by independent experts

Surecase has been penetration tested by an independent security firm. These specialists try to break into the system the way an attacker would, so that weaknesses are found and fixed first.

Staying safe from scams

Surecase will never ask for a password or a sign-in code, and nor will a genuine adviser. Nobody should share them with anyone. If a message about a mortgage looks unusual, contact the adviser or firm directly, using contact details you already have.

Questions?

Clients with questions about their documents should ask their adviser first. For anything else, please contact us.