Challenge
Credible is a neutral marketplace connecting borrowers to vetted mortgage lenders. The refi module had one non-negotiable: real rates from 10+ lenders without a hard credit pull. Every percentage point of conversion lost to a slow flow or surprise credit ding maps to millions in lost originations. And because Credible is NMLS-registered and GLBA-regulated, every design decision carried compliance weight
Discovery
We ran a week with Credible's product, security, and legal teams simultaneously. Three constraints drove every architecture choice: (1) zero hard credit pulls during pre-qual, (2) every lender partner's data isolated (partner A never sees partner B's rates or leads), and (3) full CCPA/GLBA audit trail on every byte of borrower data
What we shipped
Multi-lender rate engine
- 30-year fixed, 15-year fixed, and cash-out refi - normalized into one comparable quote set
- Per-lender rate cards pulled via REST or SFTP depending on partner capability
- Waterfall logic routes borrower profile to the 3-5 most likely lender matches
Pre-qualification flow
- Soft-pull credit via Experian and Equifax - borrower's FICO preserved
- Sub-3-minute completion on mobile, WCAG 2.1 AA compliant throughout
- Progressive disclosure: only the fields needed for the current decision branch are shown
Compliance & security
- GLBA-compliant data handling: encryption at rest + in transit, key rotation, field-level access controls
- CCPA audit trail on every borrower record - who viewed, who modified, when
- Role-scoped access: LO users see their funnel only; ops see aggregated without PII
- Pen-test readiness from day one - security lead embedded in every architecture decision
Rate-trend analytics
- 90-day pricing windows surfaced in the console so borrowers can time the lock
- Daily rate snapshots feed a "rate alert" email campaign
Why this stack
Rails for the application layer because the compliance surface benefits from a single well-audited codebase rather than a microservice sprawl. React for the borrower flow - it had to feel instant on mobile. PostgreSQL with row-level security for per-lender data isolation. Sidekiq for lender rate pulls and hard-pull escalation jobs - reliable retries with dead-letter queuing were table stakes. Datadog for observability because the compliance team needed query-level audit logs in a format they could hand to an examiner
Outcome
- 10+ lender partners integrated with waterfall matching
- Sub-3-minute pre-qual with zero hard credit pulls
- 100% GLBA / CCPA audit trail on every application - clean examiner hand-off
- Conversion from session-start to pre-qual-complete roughly doubled after launch
"Pre-qualifying in under 3 minutes - with real rates from ten lenders, no hard pull - is what moved our conversion rate. Aimeice built the compliance-grade plumbing behind it"
