Privacy & Security
How data is handled here.
A plain description of what NexusMortgageOS stores, where it lives, how long it is kept, who can reach it and how activity is recorded. Published by Goldway Partners, LLC — informational, not a substitute for a signed agreement.
What the platform stores
Loan files, borrower-submitted documents, lead and contact records, task history for automated agents, and an append-only log of actions taken in the system.
Who can see it
Access is scoped by role and by record ownership through application-level RBAC and database Row-Level Security. A user sees records they own or that their staff role covers; policies are enforced in the database layer rather than only in the interface.
Transport and storage
Traffic between browsers and the platform runs over TLS. Data at rest is encrypted by our managed database and cloud providers (Supabase / AWS) under their encryption controls.
Authentication
Sign-in uses managed authentication with email and password or Google. Sessions refresh automatically and can be revoked by signing out.
Activity logging
Reads and writes that change loan state are written to an audit trail with the actor, the action, the record and a timestamp. Audit entries cannot be edited or deleted from the application.
Reporting a concern
Security reports, privacy questions and deletion requests go to privacy@nexusmortgageos.com (or support@nexusmortgageos.com). Reports are acknowledged before any fix is discussed publicly.
Who we are
Entity and contact details
- Legal entity
- Goldway Partners, LLC (doing business as NexusMortgageOS)
- Jurisdiction
- Nevada, United States
- Privacy & compliance contact
- privacy@nexusmortgageos.com
- General support
- support@nexusmortgageos.com
Contact us at privacy@nexusmortgageos.com for access, correction or deletion requests.
Data residency
Where borrower and lender data is hosted
Primary hosting and database storage are located in the United States, on AWS via Supabase US-West and US-East regions, with multi-region replication and encryption in transit and at rest.
Data is not stored outside the United States. Subprocessors listed below may process data in the course of delivering their service.
Retention schedule
How long each category is kept
Active loan files & pipeline data
Duration of the active subscription plus 7 years after closing or termination, to meet federal and state mortgage recordkeeping mandates (including IRS, CFPB and TRID standards).
Marketing & prospect leads
24 months from last interaction, or until an explicit opt-out or deletion request is received.
System audit logs & security trails
7 years, in line with immutable audit-logging and security recordkeeping standards.
Subprocessors
Third parties that may process customer data
| Provider | Purpose |
|---|---|
| Supabase, Inc. / Amazon Web Services | Cloud infrastructure, managed database, authentication and file storage |
| OpenAI, LLC | AI processing and intelligence layers, using enterprise APIs configured for zero data retention; customer data is not used for model training |
| Twilio Inc. | SMS and communication routing for notifications |
Audits & certifications
What is ours and what belongs to our providers
NexusMortgageOS runs on cloud infrastructure from Supabase and AWS, whose platforms maintain SOC 2 Type II, ISO 27001 and HIPAA-aligned security programs under their own audit reports. Those certifications belong to those providers.
At the application layer, Goldway Partners, LLC enforces role-based access control and database Row-Level Security, plus an append-only audit trail of state-changing actions. Provider audit reports can be requested during procurement, subject to each provider's terms.
Goldway Partners, LLC does not currently publish its own SOC 2, ISO 27001 or HIPAA certification for the NexusMortgageOS application.