Backup For
Mortgage Brokers & Loan Officers

The loan-origination files you cannot easily recreate

Most small-business files can be reconstructed with time: resend the invoice, call the client, re-download the form. Mortgage loan files are different. They are assembled from documents provided by a specific borrower at a specific point in time: pay stubs, W-2s, bank statements, tax returns, employer letters, asset statements. Those documents were collected once. If the file is lost, the broker has to go back to the borrower and start the collection process from scratch, often in the middle of an active transaction with a closing date that cannot move.

Below is a complete picture of what an independent mortgage broker office should be able to recover from backup, for a specific loan file and a specific date, on demand.

• Borrower document packages: income documentation (pay stubs, W-2s, employer letters, profit-and-loss statements for self-employed borrowers), bank and asset statements, tax returns, and any supplemental documentation collected for a loan file
• Loan application files and the working copies maintained throughout processing, including any versions generated when a borrower updates or corrects information
• Rate lock confirmations, lock extension records, and any written communication about pricing commitments tied to a specific loan and closing date
• Conditions lists and condition-clearance documentation: underwriter-issued conditions, the responses submitted to clear them, and any approval or sign-off correspondence
• Disclosure packages: the Loan Estimate, Closing Disclosure, and any revised disclosures generated during the transaction, with the dates and version context that accompany them
• Closing packages and final loan documents, including the signed closing disclosure, settlement statement, and any post-closing correspondence
• Pipeline records: the running list or database of all active, pending, and recently closed loans, including status notes, key dates, and contact information
• Referral-source and Realtor-partner records maintained in your CRM: contact details, deal history, notes from conversations, and communication logs that represent years of relationship building
• Marketing materials, email campaigns, co-marketing content created with referral partners, and the files behind any active lead-generation activity
• Loan-origination system (LOS) data exports and local database files if your office runs any portion of the LOS locally or maintains a local cache
• QuickBooks or other accounting files, including commission records, operating expense history, vendor payments, and tax-year data
• Licensing, E&O policy documents, state registration records, and other business-compliance files the office maintains for its own reference

A loan file in progress represents weeks of back-and-forth with a borrower, a lender, and often a Realtor partner. Losing it is not an inconvenience. It is a disruption to a live transaction that may have a rate lock or closing date attached to it.

Why this data is different from most small-business files

Loan origination creates a category of files that are time-stamped, person-specific, and assembled through a process that cannot simply be rerun. A borrower's bank statements from three months ago are a snapshot of their financial position at that moment. A rate lock confirmation is a commitment tied to a specific date and terms. A conditions list is the underwriter's specific requirements for a specific file. These are not documents you can regenerate by calling a vendor or re-downloading from a portal.

The pipeline record is a second category of irreplaceable data. For an active broker office, the pipeline is the operational backbone of the business: every loan in progress, where each one stands, what is owed to each borrower and referral partner, and what needs to happen by when. If that record is lost or corrupted, the office is operating blind during the recovery period, and the information has to be reconstructed from memory and from scattered email threads, if it can be reconstructed at all.

Referral-source and Realtor-partner records fall into the same category. Those relationships were built over years. The contact details, the deal history, the notes from conversations and shared transactions: that information lives in a CRM or a contact database on the broker's own machine. When that machine fails, so does the database unless there is an independent backup.

Note that this page is about the mortgage broker's own working files and loan pipeline. The real estate agent on the other side of a transaction faces a different but related data picture. For that side, see backup for real estate agents and brokers.

Where backup gaps hide in a broker's office

• The LOS stores everything, so the assumption is that data is safe. Your loan-origination system (LOS) holds loan data in its own database, and for cloud-hosted systems, that database is maintained by the vendor. But locally stored exports, the PDFs and document packages you have saved to your desktop or a shared drive, the pipeline reports you have exported to a spreadsheet, and any local configuration files for the LOS are not in the vendor's cloud. They live on your machine, and they are not backed up unless you have configured a backup that covers them.
• Borrower documents saved to a desktop folder and nowhere else. Many small broker offices receive borrower documents by email or through an upload portal and then save them to a folder on a local machine for working access. That folder is often not on a server and not part of any backup job. One hard drive failure or one ransomware event, and every document in every active file is gone.
• Cloud sync of the documents folder treated as a backup. Syncing a folder to a cloud storage service is a useful habit, but it is not the same as an independent backup with version history. When a file is accidentally deleted locally, the sync removes it from the cloud copy. When ransomware encrypts local files, the encrypted versions sync to the cloud within minutes and overwrite whatever was clean. A backup with its own independent version history is what allows recovery from those events. For more on this distinction, see cloud sync vs. backup.
• The CRM or pipeline tracker living only on one laptop. If your CRM is a desktop application or your pipeline is tracked in a spreadsheet or local database on a single laptop, that data is a single point of failure. The CRM vendor may back up their hosted database, but any local copy, local export, or locally maintained pipeline spreadsheet is not covered by that. If that laptop is stolen, dropped, or hit by ransomware, the pipeline and contact records go with it.
• QuickBooks running locally with no off-site backup. Intuit's QuickBooks documentation specifically recommends keeping backup copies in multiple locations, including off-site. A local QuickBooks company file that is not included in an off-site backup is one machine failure from being unrecoverable. For a broker office where commission records and tax data live in that file, the stakes are significant. The accounting and bookkeeping backup guide covers this category in detail.
• No tested restore from an actual backup date. CISA explicitly recommends periodic restore testing, not just confirming that backup jobs completed. For a mortgage office, a practical test is confirming that a specific loan file folder, with borrower documents and correspondence intact, can be retrieved from a backup taken on a specific past date and that the files open and contain the expected data. A backup whose restore process has never been exercised is a backup whose reliability is unknown.
• Historical closed-loan files on an old external drive. Completed loan files are often moved to an external drive or a storage folder that is no longer actively backed up. Those drives fail over time. Getting historical loan files into a managed, monitored backup is not complicated, but it does require deliberate action before the drive fails.

What to back up for a mortgage broker office: a working list

The principles below reflect CISA small-business backup guidance and the #StopRansomware campaign framework, applied to the practical data types a mortgage broker office generates. This is not legal, compliance, or records-retention advice. What files your office is required to retain, for how long, and under what conditions is a question for your own compliance counsel or qualified advisors. This is about whether your files can actually be recovered if you need them.

• Active loan file folders, backed up continuously throughout the origination process. A loan file is built incrementally over weeks. Backup coverage needs to reflect that: new borrower documents that arrive on a Tuesday should be in an off-site backup by Wednesday, not waiting for a weekly job. CISA's 3-2-1 principle calls for at least three copies of data, on two different media, with one off-site. Active loan files should meet that standard at every stage of the pipeline, not just at closing.
• Pipeline records and CRM exports. If your pipeline is tracked in a local spreadsheet, a local application, or a locally installed CRM, that file should be in your backup scope. If your CRM is cloud-hosted, confirm whether local exports or local data files are being created, and include those in scope as well. The pipeline is the operational record of the business, and losing it during an active production period is a serious disruption.
• Rate lock and conditions documentation, with the version history that shows dates. Backup version history matters here. A rate lock confirmation from a specific date, a conditions response submitted at a specific time, a disclosure revision sent on a specific day: these are documents where the date and version context carries real weight. A backup that retains only the most recent version of each file provides a thinner record than one that maintains version history over a meaningful window.
• QuickBooks and accounting files. Commission records, operating expenses, and tax-year data for the business carry the same recovery requirements as the loan files themselves. Intuit's own QuickBooks backup documentation recommends off-site copies. The accounting and bookkeeping backup guide covers the specifics of protecting this data category alongside your business's financial files.
• Marketing and referral-partner content. Co-marketing materials, social media content templates, email campaign files, and the working documents behind any lead-generation activity are business assets that took time to produce. They should be in backup scope alongside the operational files.
• Backup data encrypted in transit and at rest. Loan files contain borrower financial information collected during origination. Note that a backup service protects file availability through recovery, not data security or breach prevention. Backup data should be encrypted before it leaves your machine and remain encrypted in storage, as a baseline posture for any business data.
• Monitoring that notifies you if a backup job fails. A backup that fails silently and is not discovered until a file is needed provides no protection. Missed or failed job alerts are a baseline expectation, not a premium feature.

For a broader view of your office's overall backup posture, work through the small-business backup checklist. If ransomware is a specific concern, see ransomware restore readiness for a grounded look at what makes a backup recoverable after an encryption event.

Ransomware and a broker office: the specific problem with loan files

Ransomware encrypts files and demands payment to restore access. For most businesses, the damage is financial and operational. For a mortgage broker office, the timing dimension makes it particularly damaging: a ransomware event in the middle of an active pipeline means active loan files with upcoming closing dates are suddenly inaccessible. A borrower cannot submit documents. A rate lock cannot be tracked. A lender cannot receive a conditions response. The clock keeps running on deadlines while the office scrambles to recover.

This is what makes an independent, off-site backup with version history the only real answer to ransomware for a broker office. A backup that is connected to your network at the time of an attack, such as a mapped network drive or a NAS that is always online, can be reached and encrypted alongside your working files. An off-site backup that is independent of your local network, with a retention window long enough to span the typical gap between infection and discovery, is what allows you to restore clean versions of loan files from before the encryption event.

CISA's #StopRansomware guidance specifically recommends maintaining offline or off-site backups and testing restore procedures. The FTC's small-business ransomware guidance echoes this: the backup that protects a business from an encryption event is one that was verified before it was needed. A backup whose restore process has never been tested is a backup whose reliability in a real event is unknown.

For a more detailed look at ransomware backup planning, see ransomware restore readiness.

Getting started with Everyday Backups for your broker office

Everyday Backups installs on Windows, and setup does not require IT expertise. You configure which folders to protect, and the service handles encrypted, monitored, off-site backup automatically. Paid plans start at $5.99/mo.

For a mortgage broker office, the typical starting point is the main loan file folder on the primary workstation, the folder where borrower documents are saved, and the accounting or QuickBooks folder. From there, coverage can be expanded to include the CRM data directory, pipeline exports, marketing files, and any other machines in the office where loan data lives.

If you are not sure where your office's backup gaps actually are before you start, our team offers a free 15-minute Backup Risk Check. It is a brief human review of your current setup, at no obligation. You can schedule it at the link in the band below, or call 850-980-3691 to talk to someone directly.