Hmmmm. On one hand "closing.wtf" definitely stands out... So many startups have boring branding. But on the other hand, you are building in a legacy space. It's important to build trust & pay attention to the feedback here.

Does your target demographic understand "startups" or do they just want to solve the problem?

No one should be handing out their address, mortgage information, and other sensitive details to someone who can't spend at least $300 on the bare minimum appearance of legitimacy.

What, exactly, does SOC 2 have to do with anything?

Can you answer the question of why this tool doesn’t work when redacting irrelevant personal information? I took my own info, redacted personal information you don’t need, and it doesn’t work.

I redacted my personal information from my loan estimate and your system couldn't process it. I don't see why you need that information to pull the closing cost numbers?

It is fair to describe the pains of not getting analysis on mortgage loan estimates, but what I think folks are looking for is some kind of authentic answer to the problem posed.

For example, you could advise the person uploading to remove PII prior to the upload, and link to pdf editing tools that allow them to do that.

You could say that not including PII like full name(s) found on just about every loan estimate does not take away from the value of the tool.

Another thing that could be done is to provide clear means for removing any data uploaded, or opt-out pre-upload of any data being used for training.

For example by creating an account first.

Providing some skin in the game such as putting the removal behavior in the terms of service and a personal guarantee to do everything to ensure sensitivity to privacy of this information will be handled carefully staking your reputation, probably would help.

A side business I have is people who contact me because they just got scammed or need help knowing if something is a scam.

One of the things I tell them is to never upload financial documents containing personal information unless:

- The company they’re uploading it to is well known like a major bank and the domain in the address bar matches.

- They know the company they’re dealing with - which means a business address at a minimum and preferably a phone number.

- Avoid anything which claims to save money or be necessary which has a call to action to start uploading personal, documents.

This site fails all 3 tests. I was able to find the founder via the name and LinkedIn link. But at least put up a legitimate business name and something like a PO Box.

Registering a business name is $35 where this developer is located. A PO Box is around $80 a year. The name “closing.wtf” doesn’t seem to be registered with the state as a legitimate business. These are all red flags to “avoid”.

If you’d like a free cybersecurity analysis of your site, I’d be happy to offer a few free expert consulting hours to aain. Reply here and I’ll contact you on LinkedIn.

Yep. When we closed on our house we got a whole lecture from the title company about how frequently data breaches lead to wire fraud and to not trust anyone. Mortgage originators are constantly under attack to try to get at the information that OP is asking people to just casually upload.

Their aggressive dismissal of the concern is not a good look.

People aren't concerned about giving their details to a mortgage servicing company, they're concerned about giving their details to a random website called "closing.wtf", which promises to provide mortgage advice for free with no other obvious revenue source.