BROKER SERVICE CONNECT
Broker Service Connect — Privacy Policy
Effective date: October 1, 2026Last updated: October 1, 2026
Broker Service Connect ("BSC", "we", "us", "our") provides a back-office platform to mortgage brokerages and the companies that support them ("clients"): loan and pipeline tracking, loan-file stacking and compliance, commission calculation and reconciliation, payroll and bank reconciliation, staff onboarding, lender information and related tools. This policy explains what information the platform handles, why, who it is shared with, how long it is kept, and the choices available.
It applies to the BSC web application at https://mybschub.com (and the addresses that redirect to it, including app.brokerserviceconnect.com), to the emails the platform sends, and to the pages a client's contacts open from those emails (for example a lender's account-executive update page or a new-hire join page).
1. Our role
BSC is a service provider to its clients. Information about a client's own customers — for example the borrowers on a loan — is collected by the client brokerage for its own purposes and under its own privacy notices. BSC processes that information only on the client's behalf, under our agreement with the client and our Written Information Security Program, and not for any purpose of our own.
For the people who sign in to the platform, and for lender contacts who use the pages we send them, BSC decides how that account and contact information is used, as described below.
2. Information we handle
- Account information for people who use the platform: name, work email address, phone, title, role and brokerage; the Microsoft or Google account a person signs in with, if any; sign-in history and security events (sign-ins, denials, multi-factor enrolment, sign-outs); and, where a person sets one, a password stored only as a salted one-way hash.
- Employee and contractor information a client provides, or a new hire enters through the join link the client sends them, for onboarding, licensing, compensation and payroll reconciliation: name, work and personal contact details, position, branch, NMLS number and licences, hire and separation dates, compensation plans, commission and payroll payment records, and the onboarding and employee-file checklist.
- Loan information from the client's loan origination system, its loan registration forms or entered by its staff: loan identifiers and numbers, status and milestone dates, loan amount, rate, purpose, program and occupancy, property city and state (and, where a registration form supplies it, the property's street address), lender, the loan officer and processor, and the names of the borrower and any co-borrower. We do not store Social Security numbers, dates of birth, government ID numbers, full bank account numbers or full credit reports in our database.
- Documents a client uploads. Loan-file and hiring paperwork is kept in the client's designated document storage (Microsoft SharePoint), not in our database; our database keeps a record of the file (name, type, size, checksum, category) and of every time it is opened or downloaded. Company reference documents and photos or videos from company events may be stored by the platform itself.
- Bank transaction information from a client's own business bank account, when the client connects that account through Plaid (section 4): deposit and payment amounts, dates, the bank's transaction descriptions, and the account's name and last four digits. We never receive or store bank sign-in credentials.
- Lender contact information: names, phone numbers and email addresses of lenders' account executives, the updates they make through the link we send them, and the emails they send in reply to a loan scenario, which are kept with the request and forwarded to the loan officer who sent it.
- Communications: announcements, training records and acknowledgements within the platform, and a record of each email the platform sends (recipient, subject, time and delivery status). Copies of the emails themselves are kept in the platform's sending mailbox in Microsoft 365.
- Technical information: IP address, browser type and request logs, used for security, rate limiting and troubleshooting.
3. How we use it
To provide the platform to our clients: to record and track loans; to check loan files and staff records against compliance requirements; to calculate compensation and reconcile it against payroll and bank deposits; to onboard staff and review who has access; to route loan scenarios to lenders; to send notifications and email; and to keep the service secure (authentication, multi-factor sign-in, fraud and abuse prevention, audit logs) and meet our legal obligations.
We do not sell personal information, share it for cross-context behavioural advertising, or use it to train artificial-intelligence models. We do not use it for advertising of any kind.
Optional AI document review. Where a client switches it on, the platform can read a loan document the client has uploaded to suggest which checklist item it belongs to and to check it against the client's stacking rules. A person at the client confirms or rejects every suggestion. This feature is off unless a client enables it; when it is on, the document and the loan details needed to check it are processed by our AI provider (section 5) only to produce the suggestion, under terms that do not allow the provider to keep the document or use it for training.
4. Bank connections through Plaid
We use Plaid Inc. ("Plaid") to connect a client's business bank account so deposits can be matched to funded loans. When a client connects an account, the account holder signs in to their bank through Plaid's own screens and gives consent there; Plaid then provides us read-only transaction data. By connecting an account you acknowledge that Plaid collects and processes that information under the Plaid End User Privacy Policy. The access token Plaid issues is encrypted by us and is removed when the account is disconnected.
5. Who we share it with
We share information only with service providers that run the platform on our behalf, under terms that limit their use of it:
| Provider | What it does for us |
|---|---|
| Vercel | Application hosting; cookieless page-view and page-speed measurement (page addresses only, with sign-in and invitation codes removed) |
| Neon | Managed database |
| Microsoft (Microsoft 365, Entra ID, Exchange, SharePoint) | Sign-in, sending email, document storage |
| Sign-in, where a client's staff use a Google account; email delivery of a client's scheduled payroll report before it is imported | |
| Plaid | Read-only bank transaction data (section 4) |
| Anthropic | AI document review, only where a client enables it (section 3) |
| GoDaddy and Cloudflare | Domain names and DNS (no access to platform data) |
Information also reaches the platform from the integrations a client chooses to connect — for example its loan origination system (ARIVE, through Zapier), its loan registration forms (Jotform, through Zapier) and its payroll provider (Rippling, through a scheduled report). Those providers act under the client's own agreements with them.
We also disclose information when the law requires it, to protect the rights, property or safety of BSC, our clients or others, or as part of a merger, acquisition or sale of the business, in which case the successor is bound by this policy and clients are notified.
Client separation. Each client brokerage's information is kept apart and is never shared with another client.
6. Security
Information is encrypted in transit (HTTPS/TLS) and at rest. Bank access tokens and multi-factor secrets are additionally encrypted within the application. Access is limited by role and by brokerage, protected with multi-factor sign-in for administrative and management roles (and through Microsoft or Google for staff who sign in with those accounts), reviewed quarterly, and removed automatically when a person leaves their company. Every change to a record, every sign-in and every document read is logged. When a password is set, we check it against the Have I Been Pwned list of breached passwords; only a five-character fragment of a one-way hash of the password is sent for that check, never the password itself or any account detail. Our Written Information Security Program describes these safeguards and our incident response.
No system is perfectly secure. If we become aware of a security incident affecting personal information, we will notify our affected clients promptly so that they can meet their obligations, and we will notify individuals and authorities where the law requires us to.
7. Retention
We keep information for as long as the client relationship requires and as the law requires:
- Loan files and loan records: by default 5 years from funding (or from closing where the loan did not fund); a client may set a longer period.
- Employee files: by default 7 years from separation; a client may set a longer period.
- Account, audit and sign-in records: while the client relationship continues and up to 7 years afterward.
- Bank transaction records: while the client relationship continues and up to 7 years afterward.
A legal hold stops deletion. Deletion is a recorded, confirmed step, not an automatic purge. When a client leaves, we return or delete its information as our agreement with the client provides.
8. Cookies
The platform uses only functional cookies and browser storage that it needs to work: a session cookie that keeps you signed in, a short-lived cookie that protects the sign-in flow, a cookie that remembers your time zone so dates display correctly, a cookie that remembers whether the side menu is open, browser storage that remembers your light or dark display setting, and, for platform staff, a cookie that remembers which brokerage you are viewing. While a client connects a bank account, Plaid's own window may set its own cookies under Plaid's policy. We do not use advertising, analytics or third-party tracking cookies.
9. Your choices and rights
- Your account. You can see your account details in the platform, change your password, set up multi-factor sign-in and sign out of every device. To correct your details or close your account, ask your company's administrator.
- Information a client provided. Requests to access, correct or delete information that a client brokerage provided about you (as its employee, contractor or borrower) should go to that brokerage; we will help it respond. If you contact us directly, we will pass your request to the client.
- Bank connections. A client can disconnect a bank account at any time.
- State privacy laws. Depending on where you live, you may have additional rights (for example to know, correct or delete personal information). Where BSC is the service provider, we act on the client's instructions.
We will not discriminate against anyone for exercising a privacy right.
10. Children
The platform is for business use and is not directed to children. We do not knowingly collect information from anyone under 16.
11. Changes
We will post changes to this policy at this address with a new effective date and, for material changes, notify client administrators before they take effect.
12. Contact
Broker Service Connect10265 W. Camelback Rd. #104, Phoenix, AZ 85037Contact: Justin Thorstad — justin@libertasrealestate.com