Ocrolus

Take the models away and what remains is manual document review, the incumbent process being displaced. Reading a thousand document types at stated accuracy above 99 percent, regardless of format or quality, is model work with no rules based alternative. So is deriving income, cash flow and fraud signals from them. The measured effect shows it: a named lender cut bank statement review from five hours to about ten minutes. One newer component, the conditioning engine, is described as deterministic by design, a deliberate exception rather than the pattern.

The positioning is explicit and comes from a customer rather than the marketing team, with a named executive stating that the platform is not meant to replace underwriters but to increase their output and reduce mistakes, and the company's own published commentary argues for finding the balance between automation and human expertise rather than maximising automation.

An underwriting dashboard supports review, and discrepancy detection surfaces conflicts between borrower documents and application data for a person to resolve. Less described is the newer automated conditioning capability, which generates underwriting conditions and matches supporting documents without a stated approval step.

Three external signals give a validator something to work with. Accuracy above 99 percent is published as a figure. The government sponsored enterprise approval means the income analysis has been examined by a party with money at stake. And insuring data capture accuracy through the Lloyd's market means an underwriter independently priced the error rate, a form of third party validation. Deterministic conditioning is inspectable by construction. Still absent are the methodology behind the accuracy figure and error rates by document type, along with model documentation and a validation summary.

Volume, named customers and attributed outcomes are all published. Volume is stated at roughly 750,000 credit applications a month. In small business, its cash flow analytics feed the credit models of more than 175 funders, including Enova, Square, PayPal, Bluevine, Kapitus, Fora Financial, Libertas and Rapid Finance, trained on more than 15 million applications. In mortgage, the named list runs from Better, Zillow and Newrez to Veterans United, CrossCountry Mortgage and AFN.

Outcomes are attributed to named institutions, with named executives quoted. At one lender, bank statement review fell more than 90 percent and time to close fell 23 percent. A community bank saves 8,500 staff hours and $90,000 of processing expense a year. Processing time fell about 90 percent at another institution, and underwriter time in file fell 29 percent at a third. The published customer count fell from more than 500 in late 2024 to more than 400 in early 2026.

The conditioning engine is described as deterministic by design. It is grounded in selling guide requirements rather than generative, a deliberate choice to keep a component that maps directly onto agency rules out of probabilistic territory. Accuracy above 99 percent is published as a figure rather than asserted vaguely. What is not addressed is the training boundary. Nothing states whether borrower documents processed for one lender inform models serving another, and no model providers are identified.

The documents this platform reads are the most revealing financial records a person holds. A bank statement shows where someone shops, worships, seeks medical care and sends money, and Ocrolus reads them at roughly 750,000 applications a month, alongside pay stubs and tax forms. Its security portal lists GLBA, CCPA, CPRA, VCDPA, PIPEDA and GDPR among its compliance commitments and covers data erasure, breach notification and privacy training.

A standard data processing addendum is available on request from contracts@ocrolus.com, and privacy@ocrolus.com takes requests from data subjects and customers. The GLBA detail and any retention schedule sit behind the portal's access request rather than in public.

Ocrolus runs an information security portal on SafeBase at security.ocrolus.com. It offers an ISO 27001 certificate, SOC 2 and SOC 3 reports on a half yearly audit cycle, a PCI DSS report, CSA STAR Level 1, a vulnerability assessment and penetration test report and the CAIQ questionnaires. Its compliance list also covers GLBA and New York's 23 NYCRR 500.

The portal states a four hour recovery time objective and names PayPal, Plaid, SoFi, CrossCountry Mortgage and Brex among the firms that have reviewed it. The detailed reports and most policies sit behind an access request.

Two formal agency programs anchor the regulatory position, not general compliance language. Ocrolus integrates with Fannie Mae's Income Calculator for self employed and rental income and with Freddie Mac's AIM Check for wage earners, so eligible income calculations carry representation and warranty relief and move repurchase risk off the lender for calculation defects.

The relief covers the calculation, while the lender keeps the warranty on the data supplied, and data capture accuracy is insured separately through Lloyd's of London. Product scope maps onto agency selling guide requirements and federal loan program rules. All of this sits in mortgage. Small business and consumer lending carry no equivalent agency program.

The inclusion case is real and comes from a customer rather than the vendor. A community bank executive describes an expanded lending base reaching borrowers with non traditional income sources, which is exactly what cash flow underwriting is supposed to achieve. The unexamined side is what bank statement analysis surfaces: spending patterns, transaction categories and deposit sources that correlate with neighborhood, employment sector and immigration status.

Extraction accuracy itself varies with document quality, which is worse for gig and self employed borrowers than for salaried ones. Lending falls under ECOA, and no fair lending testing, demographic accuracy breakdown or adverse action documentation is published.

Two independent risk transfers back the liability position, not a promise. Data capture accuracy is insured through the Lloyd's market. A third party underwriter assessed the error rate and stands behind it financially, which is stronger than a self issued guarantee because someone with no interest in the marketing priced the risk. Separately, income outputs eligible for representations and warranties relief move repurchase exposure away from the lender for income calculation defects. Both protect the institution rather than the borrower: a wrongly declined applicant still has no route to see or contest the extracted figures behind the decision.

The subprocessor list is public and it names a model provider. OpenAI appears on the security portal alongside Snowflake, Google Cloud and Amazon Web Services. Which tasks OpenAI's models perform is not stated, whether classification, extraction, fraud detection or the newer conditioning work, and no model versions are named.

The data chain itself is short: inputs are documents the borrower supplies and records already held in the lender's origination system, not purchased third party data, which removes a whole class of fourth party exposure.

Integration runs into the system of record rather than beside it. Direct integration with the dominant mortgage loan origination system covers document sync, indexing and matching, so output lands where underwriters already work and automated conditions attach to the live loan file, which is the mortgage equivalent of core banking integration and the hard part of this market.

Public interface documentation supports direct build, and a lending software partner embeds the technology for its own customer base, extending reach to institutions that would not procure it directly.

Delivery is cloud hosted software for domestic lenders, running on Amazon Web Services, with Google Cloud and Snowflake also named as subprocessors. The security portal states a four hour recovery time objective and lists business continuity and disaster recovery policies. Borrower bank statements, pay stubs and tax forms stay within loan files under record keeping rules measured in years. No hosting region, tenancy separation or residency option is published.

No rates, tiers, billing unit or minimum are published. The likely unit is easy to guess and still unconfirmed: a platform processing 750,000 applications monthly is almost certainly priced per document or per application, with volume banding. The published customer outcomes are all denominated in hours and dollars saved, with no cost placed against them.

Coverage spans lending in its full breadth. Mortgage, small business funding, consumer lending and auto finance each get distinct material. The named customer list runs from large technology lenders and payment companies through mortgage originators to community banks and agricultural credit institutions, a wide reach across institution size. Adjacent verticals extend it further without diluting the lending focus: legal and healthcare benefits, plus tax and tenant screening.