Skip to main content
BluLoans

Security

Last reviewed August 5, 2026

Security by architecture, not just policy

The strongest security control on BluLoans is what the site does not do. There are no user accounts, no passwords, no loan applications, and no forms that collect financial information. You cannot lose to an attacker data that we never collect, and we built the site around that principle deliberately.

Here is what that means concretely:

  • No credential storage. There is nothing to log into, so there are no password databases to breach.
  • No financial data collected. We never ask for Social Security numbers, bank account details, card numbers, or application documents — not by form, and not by email (see below).
  • Client-side tools. Our calculators and funding selector process the numbers you enter entirely in your browser. Your inputs are not transmitted to or stored on our servers, so there is no server-side record of them to protect — or to breach.
  • Largely static delivery. The site is built as static pages served over a CDN, which sharply reduces the attack surface compared with dynamic, database-backed applications.

Measures we maintain

  • HTTPS everywhere. All traffic to bluloans.com is served over TLS; plain HTTP requests are redirected to HTTPS.
  • Dependency updates. The site's software dependencies are updated regularly and monitored for published vulnerabilities as part of the development pipeline.
  • Least data, least retention. The only personal data in our custody is analytics measurement and email correspondence, as described in the Privacy Policy — and both are governed by the deletion process on Data Deletion Requests.
  • Third-party review. Analytics runs through Google Analytics 4 under Google's own security program; we do not operate custom tracking infrastructure.

What you should never send us

Because our email routes are ordinary email, treat them like postcards:

  • Never email us your Social Security number, EIN paired with sensitive financials, bank or credit card account numbers, passwords, or full loan application documents. We do not need them for anything we do — BluLoans is not a direct lender and takes no applications — and no legitimate message from us will ever ask for them.
  • If someone claiming to be BluLoans asks you for money, credentials, or financial account details, it is a scam. Report it to us at the address below and to the FTC at reportfraud.ftc.gov.
  • When you apply with an actual funding provider after leaving our site, send sensitive documents only through the provider's own secured application channel — never by unencrypted email to anyone. Our guide to business loan requirements explains what legitimate lenders typically ask for, which makes off-pattern requests easier to spot.

If you accidentally send us sensitive data, tell us; we will delete it from our mailboxes and confirm.

Responsible disclosure

We welcome good-faith security research. If you find a vulnerability in bluloans.com:

  1. Email security@bluloans.com with enough detail to reproduce the issue. {{LEGAL REVIEW}} Confirm the security@bluloans.com mailbox is provisioned and monitored before launch, or update this route.
  2. Give us reasonable time to investigate and remediate before public disclosure — we aim to acknowledge reports within 5 business days.
  3. Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the issue, and do not degrade service for other users.

We commit to not pursuing legal action against researchers who follow these good-faith guidelines. We do not currently operate a paid bug bounty; we will credit researchers who want credit once an issue is fixed. {{LEGAL REVIEW}} Review the safe-harbor language above for enforceability and alignment with any formal vulnerability disclosure policy counsel prefers to adopt.

Incidents

If we ever experience a security incident affecting personal data in our custody, we will investigate, remediate, and notify affected individuals and regulators as applicable law requires. {{LEGAL REVIEW}} Breach-notification obligations vary by state; counsel to map the applicable notification statutes to the (limited) data categories we hold.

Contact

Security reports: security@bluloans.com. All other routes, including privacy requests, are listed on our Contact page.