Controls
Written 2026-10-24. This is a checklist, not an audit certificate. It does not read the live database.
In place
Who can sign in
The lender app and the admin screens ask for the admin password. A person should look at who has that password on a set schedule. This page does not record that look.
In place
Logging
Changes to switches, users, and the watchlist are written to the audit log. This page does not open the log.
In place
Legally sensitive switches
A legally sensitive switch cannot be turned on without an attorney sign-off date, and the app has no way to store that date. This checklist does not turn one on.
In place
Passwords
Passwords stay in the environment, not in the code. This page does not print one.
Written only
When something breaks
Write down the time and what you clicked. Do not turn on outreach or data sales to get around the problem. If a county site shows a CAPTCHA, stop. Do not try to get around it.