MeridianLink

Without the models, a complete lending and deposit origination system remains, fully operational. MeridianLink makes the point itself, positioning its advantage as being the system of record into which intelligence is embedded rather than the intelligence itself. The platform has been in market since 1998, and its core is loan origination, account opening and workflow, with an embedded inference line layered over it.

The agent layer branded Millie was announced in May 2026, and its first agent, Doc Agent for Mortgage, went live with early access customers in October 2026 ahead of general availability late in the fourth quarter, so the flagship agentic capability is only now reaching customers. What ships today is automated underwriting and credit risk assessment, identity verification and fraud detection, and investor pricing aggregation. Predictive analytics and the Credit Mountain capability integrated into the consumer product round it out.

Doc Agent for Mortgage works inside the existing MeridianLink Mortgage workflow with human oversight and control built in, reviewing submitted documents for completeness, quality and relevance and extracting their data so lending staff stop rekeying it. MeridianLink publishes no approval gate, no confidence threshold that routes a case to a person and no list of actions that need sign off. Its stated model is AI working continuously alongside people as a teammate rather than a replacement for human judgment.

Compliance logic is described as embedded in the workflow and decisioning is claimed to move faster without compromising accuracy, but no accuracy figure, validation approach, benchmark, monitoring cadence or drift policy is published for any model. Decision outcome monitoring is offered to the institution as an analytics feature, which lets a customer watch its own results, but that is a reporting capability rather than a vendor statement about how its models are validated.

Named customers carry quantified outcomes in full case studies. Intrepid Credit Union saves 10 to 15 minutes per mortgage file through the built in pricing engine, which aggregates investor options. 3Rivers Federal Credit Union boosted automated decisioning by 40 percent, with a 25 percent increase in instant approvals, by pairing identity verification with automated decisioning. One caveat: the outcomes are attributed to the platform rather than isolated to the inference layer.

The platform publishes no position on whether customer or borrower data is used to train or improve any model, whether tenants are isolated for inference, what is retained, or for how long. The gap is consequential given the volume of consumer credit application data flowing through the platform and the stated intention to build a suite of agents across every stage of lending on top of it.

A privacy policy and an opt out preference mechanism are published, but nothing published addresses obligations under the Gramm Leach Bliley Act (GLBA) specifically, or how customer data is handled in the inference products. That matters because the company serves consumer reporting agencies as a customer segment and runs lending origination touching consumer credit data. Both put it squarely inside the statutory perimeter of GLBA and the Fair Credit Reporting Act. The full privacy policy and the information security program page are where more detail would sit.

The security disclosure is full and specific. An annual SOC 2 Type II audit is stated as undergone, not merely aligned with, and the chief information security officer is named. The support answers publish exact controls: data at rest encrypted with 256 bit Advanced Encryption Standard, data in transit with Transport Layer Security 1.3 and a stated floor of 1.2, and passwords salted and hashed. Hosting providers, availability zone spread and the disaster recovery posture are disclosed.

A private bug bounty with a crowdsourced testing provider runs alongside a public status page, and due diligence documentation is available to customers on self service. The ISO 27001 reference is different. The security program is described as based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and on ISO 27001, which is alignment language, not a claim to hold the certification.

Whether MeridianLink has been examined as a bank service provider is not stated either way. It is not licensed or supervised in its own right as a financial institution, and it runs hosted lending origination and account opening on behalf of supervised depositories, which places it on the performing side of the bank service provider line.

When a borrower is declined, Pathway, which came with the Credit Mountain purchase in July 2026, automatically delivers a personalized adverse action experience: it explains why the decision was made and what steps the applicant can take next, and it automates and digitizes adverse action processes that have traditionally been manual and expensive.

That decline handling sits beside automated underwriting and risk insights pitched as the way credit unions and community banks reach more people in their communities, with AI powered approvals across consumer, mortgage and auto lending and account opening. No disparate impact analysis of the underwriting models themselves is published, so the inclusion pitch carries no fair lending measurement behind it. The AI enabled workflows are built to work alongside lending teams rather than replace them.

Liability terms, an indemnity position and an error remediation commitment are not published for the inference products. Pathway comes closest to recourse. Built on the Credit Mountain acquisition, it replaces conventional adverse action communication with a digital experience that explains the lending decision to the declined applicant and sets out steps to improve their standing. That is an explanation reaching the affected individual.

It offers no route to dispute the decision, no path to correct the underlying data and no explanation of the model. Its stated purpose is to keep the declined applicant with the institution rather than to give them redress.

MeridianLink names no model provider, model family or version for any shipped capability or for the announced agent layer. Microsoft Azure and AWS are named as infrastructure hosting the company's servers rather than as the source of any model, so the hosting layer is known while the model layer stays with MeridianLink to disclose on request.

MeridianLink is the system of record for lending and account opening at its customers, not a layer integrating with one. Data Connect exposes structured origination data back to the institution with data models and dictionaries, up to three years of history, and daily plus intraday refresh, so origination data can be combined with other enterprise sources. A Marketplace partner network carries third party identity, fraud and engagement integrations. The successor architecture spans lending and deposit account opening on one platform.

MeridianLink offers no customer selectable region, makes no residency commitment for any jurisdiction and does not say which products sit on which infrastructure, but the hosting model itself is named as hybrid. Products run in colocation data centers as well as on Microsoft Azure and AWS across multiple availability zones, with a disaster recovery site in a different region.

Price, a starting figure and a unit of charge are all unpublished, with no pricing page. Every commercial route ends in a demo request or an interest form, so what the platform or its intelligence layer costs becomes known only in a sales conversation.

Five distinct institution types are addressed separately rather than listed: credit unions, banks, mortgage lenders, auto lenders and consumer reporting agencies. MeridianLink says it serves more than half of all United States credit union members. Segment breadth is wide. It covers consumer lending, mortgage, and digital account opening and deposits, as well as indirect and auto, collections, analytics and background screening. The footprint is materially United States only.