Broker Radar
Security and data
Last updated November 14, 2026
The short answers your vendor-management or IT team usually asks for. Broker Radar is a service of WeStock IT, LLC (Kyle, Texas). We're a small company in a pilot, and we say so: we don't have a SOC 2 report yet. For a completed security questionnaire or a data processing agreement (DPA), email support@westock-it.com.
What data we hold
- Public license records from state agencies: names, license numbers, types, status, dates, county and sponsoring brokerage. We don't store home or mailing addresses from those files.
- Your account: name, email, password hash (or your Google sign-in), settings, saved alerts and the brokerages you follow.
- What your team adds: phone numbers you save for a lead, call and email logs, notes, and lead assignments.
- CRM connection keys, encrypted (below). We don't hold borrower or loan data of any kind.
Where it lives
- Amazon Web Services, US East (Ohio) region. The database runs on a private network inside the server and isn't reachable from the internet; only the web ports (HTTPS) are open to the public.
- Backups: daily server snapshots kept for 7 days, and a nightly database backup to Amazon S3 (encrypted at rest) kept for 30 days. Restores have been tested.
- All data stays in the United States.
How it's protected
- Encryption in transit: HTTPS only, with HSTS. Email is signed with DKIM.
- CRM keys: encrypted with AES-256-GCM before they're stored, tied to the user and CRM they belong to, and never shown again (only the last 4 characters).
- Passwords: hashed with scrypt; never stored or logged in readable form. Sign-in is rate-limited, and sign-up and password reset are protected by a CAPTCHA. "Continue with Google" is available.
- Sessions: secure, HttpOnly cookies that expire after 7 days; changing a password signs out old sessions.
- Application: a strict Content Security Policy, protection against cross-site request forgery and framing, parameterized database queries, and an app container that runs without administrator rights.
- Access: each user sees only their own data, or their team's when they're on a team. Production access is limited to the company owner.
- Updates: the server installs security updates automatically.
Companies that process data for us
- Amazon Web Services: hosting, storage, backups and email.
- Resend: email delivery.
- Cloudflare: DNS, support-email forwarding and the CAPTCHA.
- Google: sign-in, only if you use it.
- Your CRM, only if you connect it: we send the leads you choose to send.
Your data, your choices
- We don't sell your account data or your team's notes, and we don't use them for anything but running Broker Radar for you.
- On request we'll export your data or delete your account and everything your account added; backups roll off within 30 days.
- If we learn of a security incident that affects your data, we'll tell you without undue delay, and within 72 hours of confirming it.
- People listed in the license records can ask to be removed with our privacy request form.
Billing
Team and Office plans can be paid with one company invoice instead of a card per user.
See also our privacy policy and terms of service. Questions: support@westock-it.com.