How the system is built

1. What this is

myloankit is not affiliated with, endorsed by, or approved by the U.S. Small Business Administration.

myloankit is an applicant-operated tool, operated by Pigfox LLC. A business owner enters figures they already hold and receives a document: an SBA Benchmark Score against six selected published SBA 7(a) thresholds, a market analysis of the venture, and a checklist of five commonly requested application items. This is a preliminary readiness assessment, not an eligibility determination or lender underwriting decision. The applicant holds that document and chooses whether to share it with anyone. The service sends it nowhere.

It is not a lender, not a government programme, and not an application to anyone. The SBA 7(a) thresholds are used as measuring criteria because they are published, dated and citable; the document is prepared for whichever lender the applicant takes it to.

2. What is collected

The questionnaire is grouped as follows. Every field except the first is optional.

• The venture. What the applicant wants to start or currently runs, and its stage.
• The business, if it exists yet. Business name, city, state, date established, and whether it is a start-up.
• Loan request. Amount sought, total project cost, and how much of it is working capital.
• Cash flow. Annual revenue, operating expenses, business debt service, and combined cash flow and debt service across the business and affiliates.
• Balance sheet. Total liabilities and tangible net worth, for the most recent fiscal year and the current quarter.
• Collateral. Ten fields, one per asset class, because SOP 50 10 8 discounts each class at a different published percentage and a blended total could not be read against them: new and used machinery and equipment and any prior liens on it, business real estate with and without structures and any prior liens on that, furniture and fixtures, trading assets, and equity in personal real estate.
• Equity injection. Amount. The source field was removed in LK-S33: nothing read it.
• Documents held. A checkbox per item in myloankit's selected set. SBA fixes no application document list.
• Concept and market. Free text describing the concept, the offering, the trade area, the site, known competitors, and the need served.
• SBA program screen. A single choice from the activity list at 13 CFR 120.110.

The city and state are collected because the trade-area lookup geocodes them and the narrative describes the area. No street address and no ZIP is asked for: nothing here needed them, and a field that has to be explained away is a field that should not be collected. Neither the city nor the state reaches any calculation — see section 4.

The privacy page is canonical for collection and retention.

3. What is never collected

• No owner personal credit. No credit score, no credit history, no bureau data. No field asks for it.
• No consumer report data. Nothing is requested from or received about the applicant from any third party.
• No Social Security number. No field asks for one.
• No demographics. No field asks for race, ethnicity, age, sex, or marital status.

Two tests enforce this rather than convention. TestApplicationCarriesNoProhibitedField walks the collected-data structure and fails the build if a field name carries any of those attributes. TestNoFormFieldAsksForAProhibitedAttribute walks the rendered questionnaire — every field name, label and help text — so a question cannot be added without a struct field behind it.

Free-text answers about the trade area are scanned at submission and rejected if they describe the people of an area rather than its businesses.

4. What never reaches the score

No geographic value reaches the SBA 7(a) rubric. Not ZIP, city, state, county, census tract, MSA or region; not any value derived from them; and not the country.

This is structural, not procedural. TestPackageSurfaceCarriesNoGeography parses the rubric package's own source and fails the build if any struct field, function parameter, result, type, constant or variable name is geographic. There is no field for an address to occupy.

TestGeographyNeverReachesTheScore runs four identical businesses in four different cities through the whole form-to-score path and requires the resulting reports to be byte-identical. TestGeographyDoesNotMoveTheScore does the same over HTTP.

The applicant's industry does not move the number either. The 13 CFR 120.110 activity choice is a yes-or-no screen carrying no weight; TestActivityNeverMovesThePointTotal iterates every activity in the list and fails if any changes the total by a point.

Where trade-area counts do and do not apply

The count of comparable operators near a site is used in two places and excluded from a third, and the distinction matters to a reviewer.

• It never reaches the SBA 7(a) rubric. That assessment is computed only from the applicant's own figures against published SBA thresholds.
• It does affect the Market Outlook Score, which is a separate number about the venture rather than the loan file. The count is converted to a 0–100 density signal and can move that score by up to 12 points in either direction. That is real weight, and the methodology page publishes the bound.
• It informs the narrative sections as descriptive material.

Where the count cannot be gathered, the document says it was not established rather than reporting zero. A signal that was not measured is not presented as a finding.

5. How the number is computed

By a fixed, published rubric. The same inputs return the same output on any run: no model, no randomness, no clock, no network call in the arithmetic. TestDeterminism scores each fixture 64 times and compares the serialised output.

Every threshold restates a published SBA requirement and carries the instrument it came from with its effective date. The weights, thresholds and sources are published in full at the how it works page, together with what the six leave out, and in docs/RUBRIC.md in the source.

What is excluded from the denominator

A reviewer should not discover this elsewhere. The score is out of the points that could be assessed, not out of 100.

• Dimensions whose figures were not supplied. Every financial field is optional. A blank is recorded as not supplied rather than as zero, and its dimension leaves the total instead of scoring zero.
• Collateral coverage at or below $50,000, where the requirement does not apply.
• Equity injection for a business that is not a start-up, where the requirement does not apply.

Each excluded dimension is listed on the document by name, with its point value and the reason it was not assessed. A pre-revenue applicant therefore receives a score out of a smaller total, stated as such, rather than a low score out of 100.

6. Where a language model is used, and where it is not

A language model writes one thing: the concept and market narrative. It is given the six free-text answers from the concept and market section and the number of months trading. It is not given any figure the applicant entered, and since LK-S39 there is no type in the codebase by which one could reach it — the two generators that took a brief carrying revenue, rent and margin were deleted, unused, so that the guarantee rests on the type system rather than on nobody calling them.

It has no part in the arithmetic. It does not produce, adjust, review or see the SBA Benchmark Score before it is computed, it plays no part in the 13 CFR 120.110 screen, and no output of it is an input to either number.

Generated text passes a content scan before it reaches a reader, and the scan fails closed. Text that breaks a rule is discarded whole — the section is not trimmed, softened, or partially served, and the document renders without it while the figures stand unaffected. TestGenerateFailsClosedOnContent and TestStudyFailsClosedOnTheResultPage pin that behaviour across banned terms, prohibited claims, area demographics, invented dates and invented amounts.

7. What this service does not do

• It does not pull credit, and contacts no credit bureau.
• It does not obtain consumer reports, and it does not furnish information to anyone who produces them.
• It does not transmit the document, or anything else, to a lender. The applicant is the only party who can send it.
• It encodes no lender's underwriting criteria or credit box. Every threshold is an SBA-published figure.
• It does not match applicants to lenders and makes no referrals.
• It does not run a third-party script on any page carrying the applicant's figures. One third party runs on the public pages: Google Analytics, which receives the page viewed, coarse device and browser details, and an approximate location derived from the network address. It never receives form contents, figures, the score, or the document. Two other outside parties receive something. A mapping service is sent the city, the state and the industry, and nothing else, to resolve a trade area and count comparable operators in it. The language model in section 6 is sent the six free-text answers in the concept and market section and the number of months trading, and nothing else — no figure of any kind reaches it, which is a property of the brief type it is handed rather than a promise about prompt wording. Neither is sent the business name, the score or the document.
• It decides nothing. There is no field in the output type capable of recording that a loan was granted or refused, or of predicting what any lender will do.

8. Verification

This describes the system as it stands today, not an intended design.

Each downloaded document carries a reference number and a verification address in its footer. The verification page answers two things about a reference: whether myloankit issued a document under it, and when. If the holder also uploads the file, it answers whether that file is the one issued, by comparing fingerprints.

It answers nothing else. The figures, the business, the score and the narrative are not stored, so there is nothing else it could answer. The response is the same shape and the same status whether a reference exists or not.

The reference is a version 7 UUID with 74 random bits, there is no listing endpoint, and no identifier is sequential, so the set of issued documents cannot be walked. An uploaded file is read into memory under a size cap, rejected unless it opens with a PDF signature, fingerprinted, compared and discarded. It is never written anywhere.

9. Retention

This describes the system as it stands today, not an intended design.

Four values are persisted, and no applicant data. When a document is downloaded it is rendered once, the bytes served are fingerprinted, and a row is written holding a row number, a reference number, that fingerprint, and the time. The reference number and a fingerprint of this file are retained so it can be verified. Your figures are not.

The table has four columns and cannot quietly grow a fifth: the column set is asserted against the migrations and against the deployed schema, and a scan rejects any column named for an applicant attribute.

A submission is still scored in the request that carries it and is gone when the response ends. Downloading re-submits the same figures and renders the file once; that single render is what is fingerprinted and what you receive, so the reference always matches the file it was issued for.

The privacy page is canonical here.

10. Hosting and data residency

Sliplane, US West. The service is built around SBA 7(a), a United States programme, and is offered to United States businesses only.

This page describes how the system is built. It is not legal advice.