Vendor Due Diligence
Your regulators require you to conduct and document diligence on the vendors supporting regulated activity. This page exists so you can do that without a discovery call. Everything below is either independently audited, published by a regulator, or something we will hand you under NDA on request.
Why This Page Exists
Diligence Is Your Obligation, Not Our Marketing
Three separate authorities put vendor diligence on your desk, and each one asks a question we have tried to answer directly below rather than make you extract it:
- ✓ FINRA Regulatory Notice 21-29 and Rule 3110 require broker-dealers to conduct and document due diligence on vendors, including financial condition, experience, and reputation.
- ✓ The 2023 Interagency Guidance on Third-Party Relationships (OCC 2023-17 / FDIC FIL-29-2023 / Fed SR 23-4) makes business experience, financial condition, and performance during stress scored diligence factors.
- ✓ The FFIEC IT Examination Handbook directs examiners to verify that your diligence considered references from current users of the service.
The Record
What We Can Actually Evidence
Independently audited, regulator-published, or handed over on request. Nothing here is self-asserted marketing.
SOC 2 Type II
Independently audited controls for security, availability, processing integrity, confidentiality, and privacy — covering sustained operation over a period, not a point-in-time snapshot. Report available under NDA.
SOC 1
Independently audited internal controls over financial reporting — the report your financial auditors will ask for when Loffa sits inside a process that touches your books. Available under NDA.
SEC No-Action Letter (2003)
The SEC's Division of Market Regulation reviewed how our free funds letter network operates and stated it would not recommend enforcement action if Loffa ran it without registering as a broker-dealer. Published on sec.gov, unchanged since 2003.
Read the letter and its limits →20+ Years of Continuous Operation
The 2023 Interagency Guidance flags a short operating history as a diligence limitation you must document. Loffa has operated the same core workflows through 2008, March 2020, and the January 2021 volatility — under the same ownership.
Security Posture
Controls, Stated Plainly
- ✓ AES-256 encryption at rest; TLS 1.3 in transit.
- ✓ Multi-factor authentication, role-based access control, and comprehensive audit logging.
- ✓ Regular security assessments, penetration testing, and vulnerability scanning.
- ✓ Data hosted in secure, geographically distributed data centers with 24/7 monitoring.
- ✓ Time-stamped audit trails on every action, tied to the specific rule the workflow serves.
Full details, the current SOC 1 and SOC 2 Type II reports, our Reg S-P posture, and completed security questionnaires are available under NDA — request the security package and we will send it without routing you through a sales cycle.
Scope
What We Do Not Claim
A vendor that only lists strengths is a vendor you have to go verify. To save you the trip:
- — We hold no ISO certifications. Our assurance is SOC 1 and SOC 2 Type II. We would rather say that than imply a standard we have not been audited against.
- — The 2003 no-action letter is not an SEC endorsement of any product. It is the staff's enforcement position on one narrow question — broker-dealer registration — based on the facts presented at the time. We publish its stated limits alongside it.
- — We are not your books-and-records keeper. Loffa facilitates the question and the answer between two parties, and retains what it processes in WORM storage with a time-stamped audit trail. We are not a record of book, we do not maintain your Rule 17a-3 or 17a-4 books and records on your behalf, and we do not claim to. That obligation stays with your firm — as it was represented to the SEC in 2003 and remains true today.
- — Compliance with your obligations remains yours. Our platforms produce and retain the evidence; they do not transfer the underlying regulatory duty.
Need Something Specific?
If your questionnaire asks something this page does not answer, send it over. We would rather complete your form than have you guess.