Public diligence packet

Current evidence, proposed controls, and open items.

This packet is a starting point for vendor review. It distinguishes the public website from any future customer pilot and does not mark unverified controls complete.

Version 1.0 · August 12, 2026 · Owner: Avarent founders

Packet contentsScopeWebsite data flowService providersPilot boundaryControl questionsOpen itemsContacts

Scope of this packet

This page describes the public marketing website, inquiry delivery, and limited anonymous conversion measurement. It is not a representation of a production lending-data environment. No applicant, underwriting, model-input, or credit-decision data belongs in the website form.

Interpretation boundary

A future pilot architecture, data inventory, retention period, access model, and deletion procedure must be documented and accepted in writing before non-synthetic data is transferred.

Public website data flow

  1. 1
    Visitor browserPublic pages, sample PDF, or three-field inquiry
  2. 2
    RenderWeb hosting, static delivery, and API request handling
  3. 3A
    ResendInquiry delivery only: work email, institution, and evaluation question
  4. 3B
    PostHogAllowlisted anonymous funnel events only, without form values or person profiles

Paths 3A and 3B are separate. Form content is not intentionally sent to analytics.

Declared website service providers

ProviderPurposeWebsite dataStatus
RenderHosting and API request handlingOrdinary request metadata and submitted inquiry trafficDeclared
ResendInquiry email deliveryWork email, institution, evaluation questionDeclared
PostHogConversion measurementAnonymous event name, page, placement, session identifierRestricted events

Provider contracts, locations, retention, and assurance reports should be reviewed against the institution's requirements before a pilot expands beyond the public website.

Default pilot data boundary

First evaluationSynthetic or institution-approved de-identified data
Production connectionNot required and not assumed
Applicant dataProhibited until a written field inventory and purpose are approved
CredentialsNever submitted through the website inquiry form
Decision authorityRemains with the institution
Public referenceRequires separate written permission

Controls to agree before non-synthetic data

  • Data inventoryRequired, optional, prohibited, and derived fieldsOpen until scoped
  • AccessNamed users, privilege level, review, and revocationOpen until scoped
  • RetentionMaximum period and deletion triggerOpen until scoped
  • DeletionSystems covered, owner, timing, and confirmation evidenceOpen until scoped
  • Incident handlingNotification path, contacts, severity, and required cooperationOpen until contracted
  • ExitArtifact export, access revocation, data deletion, and written confirmationRequired

Current assurance gaps

SOC 2 reportNot claimed
Regulatory approvalNot claimed
Production pilot architectureNot represented on this page; defined per approved scope
Customer referencesNot published without permission and evidence
Control questionnaireAnswered for qualified reviews with evidence or an explicit gap

Named contact paths

Securitysecurity@avarent.appEnterprise and procuremententerprise@avarent.appFounder escalationGeorge and Lucas

Do not send credentials, applicant records, or live lending data in an initial email.