Security for business finance
For brokers, lenders and borrowers
The questions a due-diligence team asks us, answered plainly. Everything here describes how CoreFi works today. For the personal finance app, see how we protect your data.
Who are you?
CoreFi is a trading name of JG Core Ltd (company 16218779, England and Wales), a commercial finance broker for UK limited companies. We introduce unregulated business finance and are not authorised or regulated by the Financial Conduct Authority. JG Core Ltd is registered with the Information Commissioner's Office, registration ZC079115.
Where is case data held?
In the UK. The database, and the private file store that holds borrowers' documents, run on Supabase in Amazon Web Services' London region (eu-west-2). The application's server code runs in Vercel's London region. Every provider that handles personal data for us is listed, with its location, on our sub-processor register.
Who can open a borrower's documents?
Only the agent who owns the case and CoreFi's directors. No file has a public address: every file store is private. When an authorised person opens a document, we check they own the case (or are a director), then issue a link to that one file at the moment it is opened, which expires after five minutes.
How do your people sign in?
Every active agent and every director must pass a second factor, a code from an authenticator app, before they can see any client's information. It is enforced on every portal page, on every request to our servers, and in the database itself, which refuses case data to a session that has not passed it. Applicants still in onboarding and introducers do not see client data.
How do borrowers send us their information?
Each borrower gets a personal link to their own onboarding pack. They read and sign it, then upload their documents to it, without creating an account. What they upload goes straight to the private file store above.
What record is kept of a case?
Every change of a deal's stage is recorded with the time and the person who made it. The checks we run on public registers (Companies House, director screening, the goods vehicle operator licence register) are saved on the deal with the date they were run, so a lender can see what was checked and when.
How does a case reach a lender?
The agent who owns the case, or a director, builds the lender pack: our credit paper and the borrower's documents, in one file. It is sent by email to a named contact at the lender. Only the case's owner or a director can build it.
How long do you keep case files?
Deal records and the documents a business and its directors give us are kept for six years after the deal completes, or after the last activity on a deal that does not complete. Our privacy notice sets out retention for everything else.
Do you use AI on borrower information?
No. No AI system reads borrowers' documents or case data, and none makes or informs a credit decision. Lenders make every credit decision.
Is data encrypted?
In transit, every connection to CoreFi uses HTTPS, and browsers are told never to connect without it (HSTS). At rest, the database and file store are encrypted by Supabase. Business bank details we hold are encrypted again in our own code (AES-256-GCM) before they are stored.
How do I raise a security or data concern?
Email hello@corefi.app. Our privacy notice sets out how we handle personal data and your rights.
Last reviewed 11 November 2026. CoreFi is a trading name of JG Core Ltd (company 16218779, England and Wales). JG Core Ltd is not authorised or regulated by the Financial Conduct Authority.