Question 1

Who is Mortevo Audit for?

Accepted Answer

FCA-regulated UK mortgage advice firms, mortgage networks, and independent compliance auditors. Compliance managers, reviewers, case managers and advisers all have first-class roles in the product.

Question 2

Is Mortevo Audit certified?

Accepted Answer

Not yet. We are progressing toward a formal information security certification and will publish the certification body and scope on the Security page once achieved. We do not claim SOC 2, ISO 27001 or other certifications until independently verified.

Question 3

Where is our data hosted?

Accepted Answer

Primary storage is in the United Kingdom / European Economic Area. No customer data is transferred outside the UK/EEA for primary storage. Sub-processors used for email, AI processing and observability are listed in the Privacy Policy.

Question 4

How is the audit trail protected?

Accepted Answer

Every privileged action is written to an append-only log with SHA-256 hash-chaining. Database-level write-once controls prevent modification or deletion from the application layer. The chain can be verified at any time.

Question 5

What happens to a case after a review?

Accepted Answer

The case's state at the point of review is captured as an immutable snapshot, checksummed with SHA-256. The review is bound to that snapshot for its lifetime. If the live case changes afterwards, the reviewer sees a drift warning.

Question 6

Does Mortevo replace our CRM or advice-checking tool?

Accepted Answer

No. Mortevo sits on top of your existing systems as the compliance layer — reviews, findings, evidence and audit. Case data can be imported from your CRM.

Question 7

How does the AI work?

Accepted Answer

AI output in Mortevo cites the specific regulatory source it depends on. It drafts findings, remediation and rule explanations, but never signs off — a human always confirms. See the AI page for details.

Question 8

Can we import our own policies?

Accepted Answer

Yes. The Regulatory Knowledge Engine supports a firm-level policy library mapped to the rules each policy implements. When a rule changes, affected policies are surfaced automatically.

Question 9

What is MFA required for?

Accepted Answer

TOTP MFA is enrolled per user under Account → Security. AAL2 (multi-factor) is enforced on privileged operations — member invitation, review outcome confirmation, legal hold release.

Question 10

How are legal holds handled?

Accepted Answer

Creating and releasing holds are separate permissions. Release requires written justification. Holds block soft-delete and retention purges on affected records.

Question 11

What is your backup and disaster-recovery position?

Accepted Answer

Point-in-time recovery is enabled at the database layer. RPO/RTO targets are documented in the internal DR record and recovery rehearsals are performed on a schedule. See the Security page for the current position.

Question 12

Can we export our data?

Accepted Answer

Yes. Customer content can be exported on request in structured formats. On termination, exports are available for a reasonable period.

Question 13

How much does it cost?

Accepted Answer

Pricing depends on firm size and role mix. Contact sales for a quote — pricing conversations start from a 20-minute needs call, not a config form.

The questions compliance leads ask us first.