Security
How your information is handled.
A funding file is a business stripped to its records. This page sets out how that information moves, where it sits, who can reach it, how long it is kept, and what this site will not accept in the first place.
Last reviewed September 18, 2026.
In transit
The site is served over HTTPS with modern TLS, and requests to the plain HTTP address are redirected. Form submissions are transmitted over the same encrypted connection to the firm's customer records system. The site sets a strict referrer policy so that addresses of pages you visit here are not passed to third parties.
What the website does not accept
The intake form is deliberately narrow. Do not send bank account numbers, card numbers, government identification numbers, tax identification numbers, passwords, or images of identity documents through any form on this site, and do not attach bank statements to the intake. When the file reaches the stage where statements and identifiers are required, they are collected through a channel appropriate for them and you are told which. The calculators on this site run entirely in your browser: the figures you type into the stack calculator, the factor rate converter and the agreement organizer are never transmitted to the firm, never stored by the site, and are cleared when the page is closed.
At rest and who can reach it
Information you send is held in the firm's customer records system under access controls, reachable by the principal and by personnel whose work requires it, and not by anyone else. Access is by individual account with multi factor authentication. Personnel who work files do not have administrative rights to the records system, and access is removed when it is no longer needed.
What is shared, and what is not
A file is submitted only to the lenders and funders on a list appropriate for it, for the purpose of obtaining offers. Your information is not sold, is not rented, and is not provided to data brokers or lead buyers. Where a counterparty receives the file, it is subject to that counterparty's own handling and to the confidentiality terms of the firm's arrangement with it. The privacy policy governs.
Retention
Records of a transaction and its file are retained for as long as the firm needs them for the engagement and afterwards for the period its legal, tax and regulatory obligations require. Inquiries that do not become engagements are retained on a shorter schedule. You may ask what is held about you and ask for it to be deleted, subject to those obligations, by writing to the address below.
Reporting a vulnerability
If you believe you have found a security issue in this site, email info@citadel-ridge.com with enough detail to reproduce it. Please do not test against live forms, do not access or alter data that is not yours, and give the firm a reasonable opportunity to fix the issue before disclosing it. Reports are acknowledged and the firm will tell you what it did.
What no policy can promise
No system is perfectly secure, and this statement is a description of practice rather than a warranty. Email in particular is not a secure channel: treat anything you send by ordinary email as capable of being read in transit, and use the telephone for anything you would not want read.
Start with the file
A straight read within 2 business days.
Send the basics through the intake form: what the file supports, what is missing, and the next step if there is one. If we are not the right desk for it, we say so.