AI and Security Glossary for Mortgage Teams

Last reviewed: October 30, 2026. General information, not legal advice. These are plain-English explanations for staff, not legal definitions; where a term comes from a law or a GSE requirement, the official text governs.

Use this when you read a vendor quote, a security questionnaire or a lender’s AI questions.

The terms

Fifteen terms, in plain English
Term	Stands for	What it means	Why it matters to a mortgage team
SSO	Single sign-on	Staff sign in to many apps with one company login, such as a Microsoft or Google work account.	When someone leaves, turning off one login cuts off every connected app, and your password and multifactor rules apply everywhere.
SCIM	System for Cross-domain Identity Management	A standard way for your identity system to add, update and remove users in another app automatically.	Departing staff lose access to the AI tool the same day. Without it, an admin removes each user by hand, so keep a checklist that shows it was done.
DPA	Data processing addendum	The part of a vendor contract that says how the vendor handles personal data: purpose, sub-processors, retention, security and breach notice.	No DPA that covers the product you use means no borrower data in that product. Keep a dated copy or acceptance record.
GLBA	Gramm-Leach-Bliley Act	The federal law on how financial institutions, including mortgage brokers and lenders, protect and share consumers’ nonpublic personal information. Its privacy rule is Regulation P (12 CFR Part 1016); for non-bank companies its security rule is the FTC Safeguards Rule (16 CFR Part 314).	It is the main reason borrower data stays out of AI tools that are not under contract and reviewed.
GSE	Government-sponsored enterprise	In mortgage lending, Fannie Mae and Freddie Mac.	Both have AI governance requirements for the lenders and servicers they work with: Freddie Mac Guide Section 1302.8 (effective March 3, 2026) and Fannie Mae Supplement Section 4 (effective January 18, 2027). Lenders may ask their brokers about AI as a result.
Entra	Microsoft Entra ID	Microsoft’s work sign-in and identity service, formerly Azure Active Directory.	If you use Microsoft 365, it is usually where SSO, MFA and SCIM for your AI tools are switched on and off.
MFA	Multifactor authentication	Signing in needs a second proof besides a password, such as an authenticator code, a phone prompt or a security key.	The Safeguards Rule requires MFA for anyone accessing an information system, unless your Qualified Individual approves an equivalent or stronger control in writing.
RBAC	Role-based access control	Permissions are given to roles, such as loan officer, processor or admin, instead of person by person.	You can allow a feature or connector only for the roles that need it.
SOC 2 Type II	SOC 2 Type II report	An independent auditor’s report, under the AICPA SOC 2 framework, on whether a service company’s controls were designed well and worked over a period of time. A Type I report covers design on a single date.	Ask for the current report, check that its scope names the product you are buying, and read any exceptions.
PII	Personally identifiable information	Information that identifies a person: name, address, phone, email, date of birth, SSN, account and loan numbers, ID images. GLBA uses the related term NPI, nonpublic personal information, for consumers’ financial details.	Keep it in your borrower portal and loan origination system, not in AI tools.
ZDR	Zero data retention	A vendor option under which prompts and outputs are not stored after the request is processed, apart from listed exceptions.	Some vendors allow personal data only through a ZDR service. x.ai’s Enterprise Terms (October 27, 2026) say personal data may be submitted only through its ZDR-Enabled API.
SIEM	Security information and event management	A system that collects logs from many tools in one place and alerts someone when something looks wrong.	If you have one, send AI audit logs to it. If not, export and save the logs on a schedule.
SLA	Service level agreement	The vendor’s written promise about uptime and support response, and what you get if it misses.	If an AI tool is part of how you serve borrowers, know what happens when it is down. Self-serve plans often have none.
Data residency	Data residency	A commitment about which country or region your data is stored in.	Some lenders and security questionnaires ask where borrower data is stored. To answer “the United States”, get it in writing.
Audit logs	Audit logs	A time-stamped record of sign-ins, admin changes, user changes and, on some plans, user activity.	They are your evidence when a lender asks who had access. The Safeguards Rule expects controls that monitor and log authorized users’ activity.

Training on your data

Not an acronym, but you will see it on every AI pricing page. It means whether the vendor uses what you type or upload to improve its models. Business plans often turn it off by default. Get the promise in the contract, not just on a web page.

Give every new hire the same vocabulary

The $99 AI Policy Starter now includes this glossary as an editable document, alongside an AI acceptable use policy, a staff acknowledgment form and an approved AI tools list.

Get the AI Policy Starter, $99 AI Policy Kit, $349 Compare kits

Frequently asked questions

What is the difference between SSO and SCIM?

SSO lets staff sign in with one company login. SCIM adds and removes their accounts in the app automatically, so a departing employee loses access without anyone doing it by hand.

What is the difference between PII and NPI?

PII is any information that identifies a person. NPI is the GLBA term for nonpublic personal financial information about a consumer, such as income, assets and the fact that they applied for a loan. Protect both the same way.

Is a SOC 2 Type II report the same as being certified?

No. It is an auditor’s report on controls over a period of time. Read its scope and any exceptions.

Plain-English AI and security glossary for mortgage teams