`docs/DATA_POLICY.md`

41 lines
# CRCP Lending-Intelligence — Data Policy

Code-enforced rules for the lending layer (FDIC / NCUA / HMDA / SBA / NMLS-LO). These extend the
existing CRCP sourcing doctrine (`docs/SOURCING.md`) — public data only, evidence-first, honest blanks.

## Hard rules
1. **Public / open sources only.** No paid or proprietary data feed is required for the core product.
   Allowed access methods: `official_api`, `official_bulk_download`, `official_open_data_portal`,
   `first_party_public_web` (allowlisted), `manual_review_only`.
2. **Do not scrape or republish** Model Match, LinkedIn, CoStar, LoopNet, ZoomInfo, Apollo, MMI, Modex,
   MLS systems, NMLS Consumer Access, or any login-gated / proprietary database. Do not bypass auth,
   paywalls, CAPTCHAs, robots directives, or rate limits.
3. **No personal contact inference.** Never infer personal emails from name patterns. Never publish
   personal mobile numbers, personal emails, dates of birth, or home addresses. Business contact points
   only, and only when explicitly published by the org, a government source, or an authorized user.
4. **Evidence-first.** Every displayed factual field must be traceable to a source record: `source`
   (owner), `source_url` (official public URL), `identifier` (e.g. FDIC CERT #, NMLS #), and
   `retrieved_at`. No unlabeled calculated metric is displayed.
5. **HMDA is institution-level.** Public HMDA aggregates are never represented as any individual loan
   officer's production. Demographic HMDA fields are used only as privacy-safe market aggregates, if at
   all — never to rank or target people.
6. **No individual-production inference.** Individual loan-officer performance is shown only when a
   reliable public source explicitly states it, labeled with source + date.
7. **Manual-only fallback.** If an official source offers only a restricted interactive lookup with no
   permitted automated/bulk route (e.g. NMLS Consumer Access, CA DFPI), it is registered as
   `manual_review_only`: we deep-link to the official lookup and accept authorized manual entry — we do
   not automate it.
8. **Never fabricate.** A dataset with no permitted population path ships honestly empty with an
   explanatory empty-state, never with synthetic individuals.

## Individual loan officers (NMLS)
The `loan-officers` dataset is `manual_review_only`. It starts empty. Records are added only from an
officially-permitted source or authorized manual entry, and each must carry a public NMLS license number
plus a `source_url`. Populating it at scale from a live individual-LO feed is a **gated** decision
requiring a permitted/licensed source — surfaced to Steve, never auto-executed.

## Enforcement
- The `/api/lending/:dataset` route is allowlisted to known datasets only.
- Ingestion scripts fetch only from the official endpoints recorded in `PUBLIC_SOURCE_REGISTER.md`.
- Every row written by an ingestion script carries `source`, `source_url`, `retrieved_at`.