The questions careful teams ask before sending a file.
Last updated 24 September 2026
These are the questions we hear from data protection, legal, risk and operations teams before a first file is sent. Short answers here, with links where another page goes deeper. If your due diligence needs more than you find on this page, ask us directly: hello@rosaverified.com.
Data and privacy
Do the tapes you receive contain personal data?
No. Our solicitors' assessment is that the tapes contain no personal data in ROSA's hands. No name, full date of birth, address or contact detail appears on them, and a year of birth and a postcode district identify nobody. A loan is identified from facts fixed when it was written. We still handle every tape with the care personal data would require. The security overview describes the controls.
How long do you keep our data?
We keep each submitted tape, and the findings drawn from it, for seven years from submission, encrypted and access-logged, as the record of what was verified. A finding is only defensible if the check can be re-run on exactly the data that produced it, and every tape is hashed on arrival, so a re-run confirms the inputs were untouched. When an engagement ends, logins close, your folders are emptied and the working copies are removed. Reports already delivered stay yours.
Where does our data live?
In London. Loan tapes, findings and reports are stored across our file exchange, our processing machine and our evidence archive, and nowhere else; the archive's recovery copy is in Ireland. Each party uploads to its own private folder, and data is encrypted in transit and at rest.
Who can see our data?
Named ROSA operators, each behind multi-factor sign-in, and the file exchange supplier's own staff under the controls its SOC 2 report describes. Just as important is how little there is to see. The check runs on the minimum data that can support its findings, the tapes carry nothing identifying, and each party's submissions sit in that party's own private folder. A report is scoped to its recipient at the moment the report is built, so no client can see another client's data.
What certifications do you hold?
ROSA itself holds none today, and Cyber Essentials is on our roadmap. The infrastructure your data sits on is certified by its suppliers: the file exchange to SOC 2 Type II, and AWS to ISO 27001 and SOC 2. You never reach a system ROSA built: sign-in and file transfer run on the file exchange supplier's certified service, which is itself penetration tested. The security overview describes the rest.
What we promise, and what we don't
What exactly do you promise?
That the stated procedures ran on exactly the tapes submitted, and that every finding follows from that data under our stated method. Every tape is hashed on arrival. Every report carries a report id, the engine version and the hash of the evidence behind the report, so any report can be checked against the archive and any cycle can be re-run.
Is a ROSA report an audit?
No. We do not audit loans, express an assurance opinion, underwrite anything or guarantee that any party is honest, and a ROSA report does not replace your own diligence. A report states what the tapes show under a defined set of procedures. We keep the claim narrow so that it can be checked, reproduced and defended.
Why don't you match loans on the loan reference?
Loan references are set by the originator, differ from one feed to the next and can be re-issued at any time, so the same loan can wear two different numbers. They are the one part of the data that can change freely, and the check never relies on them. Instead we read each loan's ROSA Signature, built from facts fixed when the loan was written: the borrower, the property and the debt. Those facts appear on every funder's tape, because every feed describes the same original event.
What if a party sends you a false tape?
The check does not rest on any one party's word. Every copy of a loan is a witness to the others, so a false entry has to agree with every other copy of the same loan to pass. Findings are graded on that standard: provisional on one feed, corroborated when independent feeds agree. An edited balance breaks the loan's own arithmetic, and each month is checked against the last. What the check cannot see is the same falsehood made on every copy of a loan and kept consistent, month after month.
What can the check not see?
The check covers the feeds we receive. A funder outside ROSA sends us no feed, so the matching cannot see a pledge to that funder. Two safeguards narrow that gap. Tape submission can stand as a condition in the lender's standard funding terms, so every feed reaches us as a matter of course. And the funder register lets any funder check what it believes: ask how many funders sit behind an originator, and a signed count comes back by the next business day. When a new funder joins, every existing funder is told. Within the feeds we do receive, a missing tape holds the affected findings open; a finding is never quietly closed because a feed went silent.
The bank account check
What does the bank account check add?
The tape says what money should have moved. The bank account check reads the lender's own accounts and compares: completions out against the agreed solicitor panel, collections in against what the book predicts, and each month's amounts, destinations and timing against the line's own history. A month inside its usual range passes. A payment to a firm off the panel, or collections short of the book, is a finding. It is the third section of the same monthly report as the tape reconciliation.
Do we have to take it?
No. Tape reconciliation and tape plus open banking are two services, priced separately, and a funder takes one or both. A report without the bank check carries the tape sections in full and marks the money-movement section not assessed.
How do you read a lender's bank accounts?
Through open banking, via a regulated provider, read-only. An authorised person at the lender receives a single-use link from a ROSA mailbox, approves the connection in the bank's own login, and reconfirms it each quarter. ROSA never sees or holds bank credentials. The first connection takes the lender under an hour, and each reconfirmation a few minutes.
Which accounts do you connect?
The lender declares every account it operates when it joins ROSA, and we connect only the accounts behind funding lines that take the service: usually the line's completions, collections, returns and sweep accounts. After every authorisation, the accounts the bank returns are checked against the declared list before anything is read. An account that is not on the list is a finding, not a feed.
What bank data do you keep?
Raw transactions are read, checked and discarded within the same run. ROSA keeps the banded results, the fact pattern behind each flag and the month-by-month trend series, for the same seven years as the findings drawn from the tapes. No borrower's name, bank details or mandate reaches ROSA, and none reaches you through us. A re-run is a fresh read under the standing consent.
What happens if the consent lapses?
The report says so. A line whose service includes open banking but whose consent has lapsed is reported as an incomplete bank assessment, never quietly dropped to tape only.
What does the bank check not see?
It never reconciles a named borrower's payments and never says a property is real. It checks the lender's accounts against the lender's book, in bands against the line's own history, so a difference inside the usual range passes without comment. Fabricated loans and over-drawn funding are different risks from double-pledging, and the bank check is the first of the layers that looks at them.
Sending files and receiving reports
What data do we send?
The loan tape you already produce, untouched. For most lenders and funders that is the standard Bank of England or European DataWarehouse format, but the format does not need to be exact: we read your tape as it comes, quirks included, and never ask for new fields, a special extract or a change to your systems. The lender sends its full book; each funder passes on its own copy of the feed the lender already sends it. Each funder's copy reaches us in its own channel, sent by the funder or, where the funder agrees, by the lender on its behalf, so the lender's book is checked against what its funders were told. For the bank account check nothing is sent: the lender gives an open banking consent and the accounts are read at the bank.
How do we get files to you?
Through your own private folder on our file exchange. People use the web portal, signing in with their work email and a second factor; automated pipelines use SFTP with a credential issued to your institution. Never by email. The file name does not matter, and if you spot a mistake before the cutoff you simply upload the corrected file again; the latest copy wins.
How do reports come back to us?
Through the same private folder. Each month's report lands in the Reports area of your folder, the newest folder is the latest cycle, and we let you know when it is there. The report itself never travels by email. There is nothing to install and no shared portal.
Timings and cadence
How often does the check run?
Monthly. Each party drops its month-end tape in its own folder, the connected bank accounts are read under the lender's standing consent, the engine runs, and each party collects its report from the same folder. Findings carry over from month to month, tracked as new, persisting, escalated or resolved.
How quickly do reports come back?
Normally within three working days of the submission deadline. Where a graded finding needs the originator's response, the funders' reports follow once its three-working-day response window closes; a confirmed overlap between funders is released on schedule regardless. Your service agreement sets the formal timetable.
How long does onboarding take?
There is no integration project. You send the tape you already produce to your own private folder; we validate your first tape, confirm what we read back to you, and you are live from your next monthly cycle. A lender taking the bank account check adds one open banking consent, under an hour, and the first read brings twelve months of history so the checks are calibrated from the first report.
Confidentiality between funders
Do other funders ever see our data or our reports?
Never. ROSA will not share your loan details or your reports with any other funder. Each party submits through its own private channel and receives its own report; there is no shared portal. A funder's report covers that funder's funding line against the lender's master record and nothing else. The scoping happens when the report is built: the engine refuses to build a funder report that carries anything beyond that funder's own line.
If double-pledging is found at our lender and our loans are not involved, do we hear about it?
Yes, but only that it exists. While a confirmed double pledge on a completed loan is open elsewhere on your lender's book, your report carries a notice that a finding is open and that none of your loans are involved. It names no party, loan or figure, and it repeats each month until the finding closes. You never learn another funder's exposure, and no funder ever learns yours: the check only works because every funder can join knowing its book is never shown to anyone else.
Can we find out who else funds our lender?
Yes, through the funder register. Any funder, existing or prospective, can ask how many funders currently fund an originator and receive a signed answer by the next business day. Identities are shared where the originator consents in writing, request by request. When a new funder joins, every existing funder is told.
Anything we missed
Ask. A short conversation is usually faster than a questionnaire: hello@rosaverified.com. If you need this page as a document for your files, we will send a dated copy rendered directly from this page, so the two never differ.