FCRA compliance program
Every live verification is a consumer report under the Fair Credit Reporting Act, whatever the stated purpose. PrimaryCheck runs every order under the full set of CRA controls. This page is the operating summary; the full policies are available to customers on request.
What PrimaryCheck does as a CRA
| Duty | Section | How |
|---|---|---|
| Sell only to vetted customers | §607(a) | Business verification, signed user agreement, Notice to Users; live keys only after approval |
| Permissible purpose certification | §604 | Certified per account and checked on every order |
| Maximum possible accuracy | §607(b) | Primary sources only, conservative matching, evidence on every result, ambiguous matches reviewed by a person, partial results never reported as complete |
| Consumer file disclosure | §609 | Consumer portal: request your file |
| Disputes within 30 days (+15) | §611 | Dispute intake, re-check at the primary source, corrected report, customer notified |
| Public-record notice for employment | §613 | Notice to the consumer when a license or exclusion record is reported |
| Adverse action support | §615 | Pre-adverse and final notice kit with the report and Summary of Rights |
| Disposal | §628 | Retention schedule enforced by a nightly purge |
| Safeguards | GLBA | Encryption, access logs, SOC 2 controls |
What you must do as a user of reports
- Certify a permissible purpose and use the report only for it.
- Give the candidate a standalone disclosure and get written authorization before ordering (hosted consent does this).
- Before taking adverse action based in whole or part on the report, send a pre-adverse notice with a copy of the report and the Summary of Rights, wait a reasonable period (we default to five business days), then send the final adverse action notice. The adverse action API runs this.
- Honor state add-ons (for example, California's free-copy check box).
- Do not re-sell or share reports.
Consumer rights and disputes SLA
Consumers can request their file, dispute any item and receive a corrected report. Disputes are acknowledged the same business day and resolved within 30 days (45 when the consumer supplies new information). Customers see dispute status on the dashboard and receive dispute.resolved webhooks.
Compliance proof
SOC 2 Type II and PBSA accreditation are in progress; see the compliance page for the current state. Notices: Summary of Rights, Notice to Users, Notice to Furnishers.