Reaching the loan record behind the Haven Home Equity app

The app ships on Google Play under the package id com.simplenexus.loans.client.s__145939, per its Play Store listing — and the simplenexus.loans namespace is the tell. This is a borrower client built on SimpleNexus, the mortgage-origination platform that is now part of nCino's Mortgage Suite. Behind the friendly “apply in minutes” flow sits a structured loan file: an application, a milestone timeline, a document inbox, and a set of loan offers, all keyed to one homeowner. That file is what an integrator actually wants. This page maps what it holds and the authorized way to read it.

The lender side is a known quantity too. Haven Home Equity is a family-owned, direct-to-consumer mortgage lender, formerly Top Flite Financial, that specializes in cash-out refinance and debt consolidation; per The Truth About Mortgage's review it is licensed in 32 states and accepts credit scores as low as 500 through a program it calls Step Forward. That product mix matters for integration, because the status fields and eligibility on a cash-out refi differ from those on an FHA or VA loan.

What the borrower portal stores

Each row below is a surface the app itself shows a signed-in homeowner. The granularity column is what an integration can address; the last column is the reason anyone would wire it up.

Authorized routes into the loan record

Two or three routes genuinely apply here, depending on who is engaging the work. Each reaches the same loan file; they differ in setup and durability.

Borrower-consented interface integration

We analyze the protocol the borrower client uses to talk to its backend — the login, the token exchange, the milestone and document calls — and rebuild it as a clean interface that runs under the homeowner's authorization. Reachable: everything the borrower sees. Effort is moderate; the durable risk is a client update that shifts the calls, which we plan re-validation around. Access is arranged with you during onboarding through a consenting test account.

Lender-side authorized access

When the client is the lender, the loan records are already theirs. We integrate against the lender's own authorized tenant so the full pipeline — every borrower, every milestone — is in scope. Effort drops once access is granted, and durability is high because we are working with the system of record rather than a rendered screen.

Native export as a fallback

Where the app lets a homeowner download a status summary or a document, we can script that capture as a low-effort supplement. It covers less than the other two and depends on what the app exposes, so we treat it as a top-up rather than the core of an integration.

Which one we recommend follows from who you are. A lender wiring up its own Haven pipeline should take the tenant route — the records are yours to grant and they are the truth. A third party serving a homeowner should take the consented-session route under that homeowner's authorization, which reaches the same record without waiting on anyone else's roadmap.

A login-and-milestone request, sketched

Illustrative shapes, not published endpoints — the exact paths and fields are confirmed during the build against a consenting account. This is the chain that produces the “loan progress” view.

# 1) Borrower-authorized session
POST /mobile/auth/token
  { "username": "...", "password": "...", "device_id": "..." }
  -> 200 { "access_token": "...", "refresh_token": "...", "borrower_id": "..." }

# 2) The milestone timeline the app renders as "track your loan progress"
GET /loans/{loan_id}/milestones
  Authorization: Bearer <access_token>
  -> 200 {
       "loan_id": "...",
       "program": "cash_out_refi",
       "milestones": [
         { "key": "application_received", "at": "2026-05-30T14:11:00Z", "complete": true },
         { "key": "documents_outstanding", "at": null, "complete": false, "count": 3 },
         { "key": "underwriting",          "at": null, "complete": false }
       ]
     }

# 3) On 401, refresh once and retry. Repeated 401 means consent was
#    revoked -> stop cleanly, do not re-hammer the backend.

The program field is the one to respect. A loan tagged cash_out_refi carries different downstream conditions than an FHA or VA file, and the integration keeps that tag attached end to end.

What lands in your repo

The deliverable is a working integration, not a report. For Haven Home Equity that means:

• An OpenAPI / Swagger spec covering the auth exchange, the milestone timeline, the document inbox, and the loan-options surface.
• A protocol and auth-flow report — the token and refresh chain as it actually behaves, including the 401-means-revoked case.
• Runnable source for the key endpoints in Python or Node.js: authenticate, pull milestones, list documents, normalize to a stable schema.
• Automated tests against a consenting account, including the refresh path and the program-tagging logic.
• Interface documentation plus data-retention and minimization guidance written for a mortgage data set.

Where integrators put this

• A debt-consolidation desk that wants live loan stage without staff logging into the portal — it subscribes to the milestone feed and sees “documents outstanding: 3” in its own tools.
• A servicing or analytics dashboard normalizing Haven's milestones into a shared schema alongside other originators, so pipeline reads the same across brands.
• A homeowner-facing aggregator that, with the homeowner's consent, pulls Haven's loan options and status into one equity view next to their other accounts.

Consent and the US data-rights picture

The dependable basis here is plain authorization. A homeowner can consent to a third party acting on their loan file, and a lender owns its own borrower records outright — neither needs a regulator's permission to share what is already theirs. We work to that: scoped consent, an expiry and revocation path that the integration honors, and data minimization that suits a file full of income documents and identity fields.

The forward-looking piece is the CFPB's Personal Financial Data Rights rule under §1033. As of this writing it is not in force — a federal court in the Eastern District of Kentucky enjoined enforcement, and the Bureau reopened the rule for reconsideration through an advance notice in August 2025, per Cozen O'Connor's tracking. The April 2026 compliance date passed without enforcement behind it. So we build on consent today and watch §1033 as where the rule may land, not as current law. Mortgage data also sits under GLBA privacy obligations, and we keep access authorized, logged, and under NDA where a client needs one.

Build notes we plan around

Three things specific to this app shape the work, and we handle each on our side.

• SimpleNexus clients are re-skinned per lender — the s__145939 tenant is Haven's. We pin the integration to that tenant and run a re-validation pass when the client app updates, so a front-end refresh does not quietly break the milestone mapping.
• The lender spans 32 states and several loan programs. We map fields per program — cash-out refi, the FHA and VA Step Forward path, home equity — because eligibility and status semantics differ, and we record which program each loan belongs to.
• Sessions expire and consent can be withdrawn. We design the sync around the token-refresh window and treat repeated 401s as a revoked-consent signal, stopping cleanly rather than retrying into a wall.

Screens from the listing

Store screenshots, used here to read the surfaces named above. Select one to enlarge.

Sources and method

Checked in June 2026: the Google Play listing for the package id and what the app describes itself doing; the lender's background and product mix; the SimpleNexus platform behind the client; and the current legal status of §1033. Where a number or identifier appears above, it is attributed to the source it came from rather than asserted on faith.

• Google Play — Haven Home Equity listing
• The Truth About Mortgage — Haven Home Equity review
• SimpleNexus (nCino) — platform overview
• Cozen O'Connor — §1033 enjoined and under reconsideration

Mapped by the OpenBanking Studio integration desk · June 2026.

Other home-equity and mortgage apps in the same space

If a single integration is meant to span more than one lender, these sit adjacent to Haven Home Equity. Each holds a comparable per-borrower loan record; named for ecosystem context, not ranked.

• Figure — a digital HELOC originator whose app tracks per-borrower draw balances, application status, and funding milestones.
• Rocket Mortgage — mortgage and home-equity application state, document checklists, and servicing details behind one login.
• Spring EQ — home-equity loan and HELOC files with application progress and funding timelines per borrower.
• Aven — a home-equity-backed credit line whose app holds balances, draws, and statement activity tied to the equity.
• Hometap — home-equity investment agreements with per-homeowner terms, valuations, and settlement timelines.
• Point — home-equity investments carrying agreement documents, property valuation, and payoff projections.
• Unison — shared-equity agreements with term, valuation, and buyout data per homeowner.
• Splitero — home-equity investment with application and offer records per homeowner.

Questions integrators ask about Haven Home Equity

Haven Home Equity runs on SimpleNexus — does that change how the integration works?

It shapes it. The borrower client talks to a SimpleNexus (now nCino) backend, so we map the login and the milestone and document calls that client makes, under a consenting borrower's authorization or the lender's own authorized tenant access. The integration then tracks the same loan-status and document events the app renders, without depending on the screen layout staying still.

The lender operates across 32 states with several loan programs — how is that handled?

We scope the field mapping per program — cash-out refinance, FHA and VA loans under the lender's Step Forward Program, and home-equity products — because the status fields and eligibility differ. Each loan record carries which program it belongs to so downstream systems read it correctly across the lender's footprint.

Can the integration capture document-upload status, not just the loan stage?

Yes. The in-app document scan surface exposes per-document objects with a type, a received-or-outstanding state, and a timestamp. We model those so a checklist or completeness view stays in sync, and by default we carry the metadata rather than the underlying document images unless the engagement scopes that explicitly.

Does the loan data come from the borrower's side or the lender's side?

Either reaches the same record. A consenting homeowner's authenticated session works for a third party building on their behalf, and a lender integrating its own pipeline can grant authorized tenant access arranged with us during onboarding. We pick whichever matches who is engaging the work.

You bring the app name and what you want out of the loan record; we arrange access and the compliance side with you, then deliver the build. Start a scope or read the full terms on the contact page. Source-code delivery starts at $300 — you receive the runnable integration, the spec, the tests, and the docs, and you pay after delivery once it satisfies you. Prefer not to host it? Call our endpoints as a pay-per-call hosted API and pay only for the calls, with no upfront fee. Either path runs one to two weeks.