Consent capture
The lead form includes a consent checkbox with text you write. The consent given is stored with the lead, which supports compliant follow-up. See TCPA consent.
Borrower leads contain income, debts and contact details, so PrequalFunnel treats them as sensitive financial data. Each account's data is isolated, traffic runs over HTTPS, stored credentials are encrypted, and two-factor sign-in is available. You own your leads; we process them as your service provider and never sell or share them.
Key takeaways
- Your leads are yours; PrequalFunnel is a service provider and never sells data.
- Workspace isolation, HTTPS, encrypted credentials and two-factor sign-in.
- Leads are saved before webhooks fire, so a failed integration never loses one.
- No third-party audit certifications are claimed at this time.
Which security controls protect your account and leads?
The main controls, in plain terms.
| Control | What it does |
|---|---|
| Workspace isolation | Each account's calculators, contacts and settings are separated from every other account's; one customer cannot see another's leads |
| HTTPS everywhere | Calculators, lead submissions, the app and custom domains are served over encrypted connections |
| Encrypted credentials | Stored secrets such as your own SMTP password are encrypted at rest |
| Webhook URLs kept server-side | Destination URLs are never included in the calculator code that loads in a visitor's browser |
| Two-factor sign-in | Add a second factor to your sign-in so a leaked password is not enough to reach your leads |
| Spam protection and rate limiting | Lead submissions are checked for spam and limited to 30 requests per minute to block floods |
02
Who owns the leads your calculators capture?
You do. When a borrower submits a lead form inside your calculator, they are contacting you, the loan officer or brokerage. PrequalFunnel stores and delivers that lead as your service provider: we process it to run the service for your account, and for nothing else.
We never sell leads, share them with other lenders, add them to a marketplace or use them to market to borrowers ourselves. That is a business decision as much as a privacy one. Our customers are loan officers, and a lead tool that quietly resold their borrowers would not deserve their trust.
You control what happens next. Leads stay in your built-in CRM, and on paid plans you choose where they go by webhook. Because those destinations are yours, so is the responsibility for them: use HTTPS endpoints, limit who can see automation logs, and avoid sending full payloads to tools that do not need them.
How are consent and borrower data requests handled?
Consent is recorded with each lead, and data requests have a defined path.
Requests from borrowers
Borrowers can ask about or request deletion of their data through the data request page or [email protected]. Because you own the lead, we coordinate with you.
Requests from you
You can edit or remove contacts in your CRM. For account-level requests, contact privacy support.
No data sales
We do not sell personal information and do not share it for others' advertising.
A webhook failure does not lose the lead
Every lead is saved in your PrequalFunnel CRM before any webhook is sent. If HighLevel, Zapier, Make or your own endpoint is down, the lead and its numbers are still there and the email alert still goes out. Reliability is part of security: a lost lead is a borrower nobody calls back.
What happens to borrower data from submit to delivery?
The path a lead takes, and the protection at each step.
-
Submitted over HTTPS
The form sends contact details, consent, inputs and results over an encrypted connection, after spam checks and rate limiting.
-
Stored in your workspace
The lead is saved in your isolated account and matched to an existing contact by email, then phone.
-
Alert sent
You receive an email alert; on white-label plans, optionally through your own SMTP server, which requires an encrypted connection.
-
Delivered by webhook (paid plans)
The lead is POSTed to the destination you set. Use an HTTPS endpoint; see lead webhooks.
How accessible are the embedded calculators?
Borrowers using keyboards, screen readers or reduced motion can complete the whole funnel.
Keyboard operable
Every field, button and control can be reached and used with a keyboard alone.
Focus-trapped dialogs
Popup and dialog embeds keep keyboard focus inside while open and return it to the trigger when closed.
44px touch targets
Buttons and controls meet a 44-pixel minimum target size for touch screens.
Reduced motion
Animations are reduced when the visitor's device asks for reduced motion.
Labelled fields
Every input has a visible, programmatic label, so screen readers announce what each field asks for, in each of the six languages the calculators support.
What do we claim, and what don't we?
Security pages often overstate. Here is the honest line.
What we do claim
- The controls listed on this page are in place
- Your leads are yours and are never sold or shared
- Leads are saved before webhooks fire
- Lead submissions are rate-limited and spam-checked
What we don't claim
- No third-party audit certifications are claimed at this time
- We do not make your marketing compliant; your compliance team does
- We cannot secure webhook destinations you control
- No system is risk-free; report concerns to us promptly
Keep reading
FAQ · 10 questions
Questions loan officers ask
Who owns the leads my calculators collect?
You do. PrequalFunnel processes leads as your service provider, only to run the service for your account. We never sell, share or reuse them.
Does PrequalFunnel sell borrower data?
No. We do not sell personal information, share it with other lenders or use it for our own marketing to borrowers.
Is the lead form submission encrypted?
Yes. Calculators and lead submissions are served over HTTPS, including on custom domains.
Can I turn on two-factor sign-in?
Yes. Two-factor sign-in is available for your account and is recommended for everyone who can see leads.
Can other PrequalFunnel customers see my leads?
No. Each workspace is isolated, so one account's calculators, contacts and settings are not visible to another.
What stops bots from flooding my lead form?
Submissions are spam-checked and rate-limited to 30 per minute, which is designed to stop floods without getting in a real borrower's way.
Is PrequalFunnel certified to a security standard?
No third-party audit certifications are claimed at this time. This page describes the controls in place today.
How does a borrower ask for their data to be deleted?
Through the data request page or by email to privacy support. Because the loan officer owns the lead, we coordinate the request with them.
What happens to my leads if a webhook fails?
Nothing is lost. Leads are saved in your CRM first, and the email alert still goes out. Fix the destination and work the lead from the CRM.
Are the calculators accessible to borrowers with disabilities?
They are keyboard operable, with labelled fields, focus-trapped dialogs, 44px touch targets and reduced-motion support. Report any barrier through the contact page.
PrequalFunnel
Your next borrower is already on your site.
Give them the numbers they came for, and get the lead with those numbers attached.
Free forever on Originator. Upgrade when you want webhooks and your own brand. 14-day free trial on monthly and yearly. Cancel before it ends and you pay nothing.