Security, consent and data handling

What can the agent do without asking?

With business:read: read the profile, documents, answers, readiness, match results, deals and offers. With business:write: upload documents, update answers, run autofill and accept suggestions. None of these is visible to a lender. The two actions that are visible to lenders, selecting them and submitting, require the owner's explicit confirmation and the application:submit scope. There is no tool that moves money, signs anything, or accepts an offer; those stay with the owner and the lender.

What is stored, and for how long?

The business profile, the documents the owner uploaded, the application answers, match results and lender communications are stored to support the application and any funded loan. Documents are encrypted at rest. The owner can delete documents and close the account; retention after closure follows the privacy policy and lender record keeping obligations. The platform does not sell application data and does not auction applications to lenders as leads.

Who sees the application?

Before submission: the owner, the agent acting with the owner's token, and platform staff for support. After submission: only the lenders the owner approved, each seeing the same complete file. Lenders are bound by their own privacy obligations and may run a credit inquiry at offer stage, which they disclose. No other lender on the network sees the file.

What should the agent tell the owner before submitting?

Use language like this, adapted to the case:

"I am about to send your application and these documents (list) to these lenders (list). They will review it and may ask follow up questions or run a credit check, which they will tell you about first. Approval is not guaranteed. You can stop here, or change the list. Shall I submit?"

Wait for a clear yes. If the owner hesitates, offer to send to fewer lenders or to wait for a missing document.

How is the agent itself protected?

Tokens are bound to one business and one client registration. Tool inputs are validated and the server never executes content from uploaded documents. Review tools let the agent preview any lender facing change. Errors never include another business's data. If a token is revoked mid session, the next call fails with a clear authorization error rather than a partial result.

What are the operator's qualifications?

Levr has worked on 5,000+ business loans across the lenders on its network and operates the same infrastructure for business loan brokers and lenders. It is a BBB Accredited Business and runs a SOC 2 Type II security program. The full program, policies and the current status of attestations are kept at levr.ai/trust-security. Questions go to contact.