How we protect your data
Credit reports contain sensitive information — SSN fragments, addresses, dates of birth, account history. We treat them that way.
At rest
- Credentials, tokens, and secrets are encrypted at rest.
- Every privileged action is written to an immutable audit log.
In transit
- All traffic runs over TLS.
- Strict Content Security Policy on every page.
Access controls
- Multi-factor authentication is enforced for every staff and admin role.
- Per-IP and per-session rate limiting on every sensitive endpoint.
Deletion
- When you cancel or request deletion, your account goes into soft-delete for 30 days, then hard-delete. You can restore from the confirmation email during the 30-day window.
- You can trigger a hard delete immediately from your account data settings at any time.
Privacy policy
The full policy lives at the privacy page. Data retention specifics are at data retention.
Last updated 11 days ago.
Was this article helpful?
Related
- Is this legal?Yes. Credit disputing is a consumer right under the FCRA. What the law actually says.
- FCRA basicsA consumer-friendly tour of the Fair Credit Reporting Act sections that show up in every dispute.
- FDCPA basicsThe federal law that governs debt collectors. What they can and can't do, and what you can do when they don't.
- CROA and softwareHow the Credit Repair Organizations Act applies to credit-repair companies — and why software you use yourself isn't one.