The buyer sends you their mortgage in principle as a PDF. You forward it to the vendor's agent. Three weeks later, it surfaces in a forwarded chain to someone who shouldn't have it. The buyer's annual income is now common knowledge.
Mortgage documents are the most sensitive PDFs an agent ever touches. Handle them like the data breach risk they are.
Never forward, always re-share
When you receive a mortgage-related PDF from a buyer, never simply forward it. Save it to a secure folder, then share with the vendor's agent via a controlled channel — a portal, a password-protected file, or a secure link. Forwarded email chains accumulate recipients and lose track.
Redact before broader sharing
If the vendor wants to see the mortgage in principle for assurance, you don't need to share the full document. Use redact PDF to remove account numbers, advisor details, and any data not relevant to the loan amount approved. The vendor needs to see the lender approves the buyer — they don't need to see anything else.
Password-protect before sending
Always password-protect before sending mortgage documents anywhere. Send the password in a different channel — never in the same email as the file. This single discipline prevents most accidental leaks via forwarded email.
Retention and deletion
After the transaction completes, delete copies of mortgage documents from your active systems. Most agencies retain transaction files for six years for regulatory reasons, but mortgage-specific documents can usually be deleted earlier. Have a clear policy and follow it.
FAQ
Do I need to share the buyer's mortgage in principle with the vendor's agent?
Yes for proof of funds, but consider a redacted version showing only the approved amount, not the buyer's full financial picture.
What's the right password strength for mortgage PDFs?
A randomly generated 12-character password is plenty. Sent in a separate channel from the file itself.
Can I email mortgage PDFs at all?
Password-protected, yes. Unprotected, no. Where possible, use a secure portal instead.
What if the buyer's lender shares documents directly with both sides?
That's preferable. The lender takes responsibility for secure transmission and the agents don't sit in the middle.
Mortgage PDFs deserve different handling from listing PDFs. Password-protect them in Flint and the buyer's income stays the buyer's business.