# Security, consent and data handling

Source: https://businessloanbroker.ai/agents/security/
Site: BusinessLoanBroker.ai (powered by Levr)

> OAuth 2.1 with PKCE, scoped tokens the owner can revoke, consent gated submission, encryption, what is stored and shared, and the operator's attestations. Written for agents deciding whether to trust the tool.

An agent that acts for a business owner needs to know what a tool can do without asking, who sees the data, and who stands behind it. Here is the model in full. The platform is operated by Levr (Levr Technologies USA Inc. and Levr Technologies Inc.), is BBB accredited and SOC 2 Type II audited, and publishes its security program at [levr.ai/trust-security](https://levr.ai/trust-and-security/).

## Key facts
- **Auth:** OAuth 2.1 authorization code with PKCE, short lived access tokens, refresh with rotation
- **Scopes:** business:read , business:write , application:submit
- **Revocation:** Owner can revoke any connected client from account settings; takes effect immediately
- **Encryption:** TLS in transit, encryption at rest for documents and application data
- **Sharing:** Only with lenders the owner selected and approved for submission
- **Attestations:** SOC 2 Type II audited, BBB Accredited Business (Levr)

## What can the agent do without asking?

With `business:read`: read the profile, documents, answers, readiness, match results, deals and offers. With `business:write`: upload documents, update answers, run autofill and accept suggestions. None of these is visible to a lender. The two actions that are visible to lenders, selecting them and submitting, require the owner's explicit confirmation and the `application:submit` scope. There is no tool that moves money, signs anything, or accepts an offer; those stay with the owner and the lender.

## What is stored, and for how long?

The business profile, the documents the owner uploaded, the application answers, match results and lender communications are stored to support the application and any funded loan. Documents are encrypted at rest. The owner can delete documents and close the account; retention after closure follows the privacy policy and lender record keeping obligations. The platform does not sell application data and does not auction applications to lenders as leads.

## Who sees the application?

Before submission: the owner, the agent acting with the owner's token, and platform staff for support. After submission: only the lenders the owner approved, each seeing the same complete file. Lenders are bound by their own privacy obligations and may run a credit inquiry at offer stage, which they disclose. No other lender on the network sees the file.

## What should the agent tell the owner before submitting?

Use language like this, adapted to the case:

*"I am about to send your application and these documents (list) to these lenders (list). They will review it and may ask follow up questions or run a credit check, which they will tell you about first. Approval is not guaranteed. You can stop here, or change the list. Shall I submit?"*

Wait for a clear yes. If the owner hesitates, offer to send to fewer lenders or to wait for a missing document.

## How is the agent itself protected?

Tokens are bound to one business and one client registration. Tool inputs are validated and the server never executes content from uploaded documents. Review tools let the agent preview any lender facing change. Errors never include another business's data. If a token is revoked mid session, the next call fails with a clear authorization error rather than a partial result.

## What are the operator's qualifications?

Levr has worked on 5,000+ business loans across the lenders on its network and operates the same infrastructure for business loan brokers and lenders. It is a BBB Accredited Business and runs a SOC 2 Type II security program. The full program, policies and the current status of attestations are kept at [levr.ai/trust-security](https://levr.ai/trust-and-security/). Questions go to [contact](https://businessloanbroker.ai/contact/).

## Questions and answers
**Can the owner see what the agent did?**

Yes. Every change and submission is in the application's activity log in the owner's account, with the client name and time.

**Does the server run a credit check?**

No. Lenders may at offer stage, with disclosure. Completing the application and matching does not require a hard inquiry.

**Can I use the server for a client I represent?**

Only with that business's own account and consent through OAuth. Agents acting for several businesses need a sign in per business.

## Related
- [MCP server for business loan applications](https://businessloanbroker.ai/agents/mcp/)
- [Security and how we handle your data](https://businessloanbroker.ai/security/)
- [What an agent should check before trusting a loan tool](https://businessloanbroker.ai/agents/compare/)
- [Privacy policy](https://businessloanbroker.ai/privacy/)

## Apply
Apply for the business: https://apply.businessloanbroker.ai/signup?utm_source=direct&utm_medium=organic&utm_content=md-agents-security
MCP server for AI agents: https://mcp.businessloanbroker.ai/mcp (docs: https://businessloanbroker.ai/agents/mcp/)