by Heirloom Fair Legal
How it works What Rout reads Access method Onboarding

Direct data access for borrowers

Under your facility agreement, Rout reads claim data directly from your systems, read-only. This replaces CSV, Excel and PDF exports. This page sets out what you need to provide.

Your systems
CRM · Claims portal · Document store
Read-only pull, initiated by Rout
Rout Read only
Rout exposes nothing to you or anyone else.


How it works

Rout reads from your systems. Nothing is sent back.

You grant read-only access

A dedicated credential on the system that holds your claim and CRM data, scoped to the agreed fields (discussed individually).

Rout reads on a schedule

Every connection is initiated by Rout, outbound to your platform, at the frequency set in your facility.

Data lands under your book

What used to arrive as an export pack is stored in Rout against the relevant book and claim.

What Rout reads

The same data as your current reports.

System type Typical data read
CRM / case management Claim records, status, dates, claimant reference, lender, product, amounts
Claims portal Claim stage, outcomes, correspondence metadata, settlement figures
Document store Documents you would otherwise send to HFL
Payments / ledger Receipts and payments against claims

 Access is limited to the book funded by HFL.

Access method

Read-only REST API.

Standard

REST API

Your platform's existing API, with a read-only OAuth 2.0 client or service account dedicated to Rout. Nothing to build.

Optional

MCP server

If your platform already offers one, Rout can use it, calling read tools only. You never need to build one.

Credentials Scoped to the agreed fields and book. Rotated on request. Revocable by you at any time.
Network Rout calls from a fixed set of IP addresses, supplied at onboarding for your allowlist.
Transport TLS on every call.
Rate Scheduled pulls at the agreed frequency, within your platform's rate limits.
Spec
AuthOAuth 2.0 client credentials. If your platform has no OAuth, a read-only service-account key.
ScopeRead-only scopes. No write operations.
DataThe agreed fields only, read incrementally by last-updated date.
Typical request 
GET /claims?updated_since=2026-11-01T00:00:00Z
Host: api.your-platform.example
Authorization: Bearer <read-only token>
Limits

What Rout never does.

Write to your systems No edits, no deletes. Read-only, always.
Share your data or access Your data and credentials stay with Rout and are never passed to a third party.
Ask you to build anything You host nothing and maintain nothing for Rout.
Go beyond the field list Access stays inside the agreed fields and book.
Onboarding

Four steps.

1 Tell us your systems Which platforms hold your claim and CRM data.
2 Confirm the field list Checked against your current export packs.
3 Create the credential A read-only client, plus Rout's IP addresses on your allowlist.
4 Run a test pull You confirm the output matches your last export.
If access is lost, you restore it within 10 business days. Until then, file exports remain the fallback.
Security and data protection

How access is controlled.

Credentials are stored encrypted and used only by Rout's data-pull service.
Claimant data is processed under HFL's data-protection obligations and the terms of your facility.
Every pull is logged. You can request the access log at any time.
If your platform's terms restrict granting access, tell us at onboarding and we will agree an alternative in writing.

Contact

Email us to start onboarding or ask a question.

[contact email to be added]
Rout · Heirloom Fair Legal Rout reads from your systems. It exposes nothing outbound.