How Afterfirst MCA Protects Your Bank Statements and Data
Where you can, upload your bank statements as PDFs over an encrypted connection after you apply. Uploads are stored encrypted, and only our team opens them in storage. Email is not as secure as an encrypted upload. If you authorize sharing or ask us to send your file, we may email your statements and application details to the funders reviewing your file.
Here's exactly what's in place: how a file is handled, how statements are collected and stored, who can see them, and the browser protections the site sets. We list only practices that are running now, and Afterfirst holds no third-party security certification.
What happens to a file today?
You apply through the four-step form at afterfirstmca.com/apply, and a person on our team reads each application before any file goes to a funder, and we email you first from info@afterfirstmca.com. The calculators and checkers run in your browser, so nothing typed into them is sent to Afterfirst.
| Practice | How it works today |
|---|---|
| Sending a file | Apply through the four-step form at afterfirstmca.com/apply |
| First reply | A person reads your file and writes back before anything is shared |
| Bank statements | Where you can, uploaded as PDFs through the secure upload right after you send |
| Sharing with funders | Only funders whose programs fit, and only after you have seen our read |
How are bank statements collected?
Where you can, send bank statements through the secure upload after you apply at afterfirstmca.com/apply. Email is not as secure as an encrypted upload. Uploads are stored encrypted, and only our team can open them in storage.
How is the site protected in transit and in the browser?
The site build sets standard browser security headers on every page. The headers below are the ones it sets.
Encrypted connections and strict transport
Every page is set to load over HTTPS only. A header tells browsers to refuse plain connections for a year, on subdomains too.
Content restrictions in the browser
A content policy limits scripts, styles and form posts to the site itself, with Google Analytics and Cloudflare Web Analytics explicitly allowed for measurement. Other sites can't frame it. The camera, microphone, location and payment features of the browser are off.
Calculators run in your browser
The calculators on the site do their math in your browser. The numbers you type are not sent to Afterfirst.
What the calculators keep
The calculators set no cookies and save nothing in the browser's storage, so closing the page clears what you typed.
How is stored data protected?
When you apply at afterfirstmca.com/apply, your answers are stored in our application database with Cloudflare, our hosting provider. Bank statements you add after you send the form are uploaded as PDFs over an encrypted connection. Statements you upload are stored encrypted with Cloudflare, and a copy is sent to our team by email. A copy of your answers goes to our business email and our internal records. Only our team can open your application and statements in our systems.
The FTC's guide Protecting Personal Information: A Guide for Business is a plain-language checklist for the same questions of storage, access and disposal.
Who inside Afterfirst can see a file?
Only team staff working a file see it. Funders see a file only when it fits their buy box and is sent to them.
FAQ
Is sender data ever sold?
No. Afterfirst doesn't sell sender data, and a file is shared only with funders it's submitted to.
Has any auditor certified the setup?
No. Afterfirst has no third-party security certification. This page describes only the practices in place today.
Does our team keep credit reports?
Ask each funder how any credit review works before you sign, and how it stores what it collects. This page covers only what our team holds, set out above.
Who sees the details of my existing advances?
Only funders your file is submitted to, since they need them to price a new position. Those details are not shared outside the application process.
Does a security check add wait time to a file?
No. The form runs a short bot check when you press send, and after that the pace of a file is set by our team read and the funders.
Can I ask for my data to be deleted, and does it cost anything?
Yes. Email info@afterfirstmca.com or call 877-FUND-654, and there's no charge.
Next step
When you're ready, apply at afterfirstmca.com/apply. We shop your file to funders whose programs fit.
Call 877-FUND-654Sources
- MDN, Strict-Transport-Security header: what the HTTPS-only header under encrypted connections tells a browser to do, including the one-year duration and subdomains.
- MDN, Content Security Policy: how the content policy described under content restrictions limits scripts, styles, framing and form posts to the site itself, as this security page says.
- FTC, Protecting Personal Information: A Guide for Business: the public checklist named in the stored-data section of this security page.
Send one file.
See what fits.
Call 877-FUND-654 with questions.