Compliance
Run as a consumer reporting agency, on every order
Verification for hiring, retention or credentialing is a consumer report under the Fair Credit Reporting Act. PrimaryCheck applies the full set of CRA controls to every order, whatever the stated purpose, so there is never a question of whether a given check was covered.
Controls
FCRA controls built into the product
Customer vetting (§607(a))
Business verification, a signed user agreement and the Notice to Users before any live key is issued.
Learn more
Permissible purpose (§604)
Certified per account; checked on every order; orders without consent proof are refused.
Learn more
Hosted consent (§604(b)(2))
Standalone disclosure and authorization with state add-ons, signed on our page, evidence stored.
Learn more
Maximum possible accuracy (§607(b))
Primary sources only, conservative matching, evidence on every result, ambiguous matches reviewed by a person.
Learn more
Consumer file access (§609)
Consumers request and receive their file through the consumer portal after an identity check.
Learn more
Disputes (§611)
30-day reinvestigation (45 with new information), re-check at the primary source, corrected report, customer notified.
Learn more
Adverse action support (§615)
Pre-adverse and final notices with the report and Summary of Rights; a waiting-period clock the API enforces.
Learn more
Retention and disposal (§628)
A retention schedule enforced by a nightly purge, audited.
Learn more
Audit log
Every order, view, export, notice and change is logged immutably.
Learn more
Proof status
Stated as it stands. Nothing here is claimed before it is true.
| Proof | Status | Notes |
|---|---|---|
| FCRA program and written policies | in place | Accuracy, disputes, vetting, retention, security and incident response procedures |
| SOC 2 Type II | in progress | Controls operating from launch; audit window underway |
| PBSA accreditation | in progress | Application after the required operating history |
| E&O and cyber insurance | in progress | Bound before the first live customer; certificates on request after |
| NCQA CVO certification | planned | For health plan and hospital credentialing customers |
Security
Security practices
- Encryption in transit and at rest; secrets in a managed vault, never in images.
- Evidence stored with content hashes; reports regenerated from stored evidence.
- Per-account isolation on every query; role-based team access; signed webhooks.
- No SSNs collected or stored.
Notices and texts: Summary of Rights, Notice to Users, Notice to Furnishers, disclosure and authorization.
Compliance documentation
Questions from your compliance team?
We share policies, the controls matrix and audit evidence with customers under NDA.