The gate is the product.

Purpose is recorded on every search

In the app you declare a purpose for the session; through the API each request carries a purpose_code. Either way every search records it, with the matter reference. A search the account is not credentialed for returns 403 before any source is called. This is not configurable.

Credentialing

Before an account is activated we verify:

• Entity registration and standing
• Professional licence, where required
• Which permissible purposes apply
• A signed access agreement

Accounts get only the data classes their verified purposes support.

Gramm-Leach-Bliley Act

GLBA restricts access to consumers’ nonpublic personal financial information and makes it unlawful to obtain customer information from a financial institution under false pretenses. Nothing on this platform is obtained by pretexting.

Driver’s Privacy Protection Act

Motor vehicle data requires a verified DPPA permissible use, recorded per search. Without one the search returns 403, not an empty result.

Fair Credit Reporting Act: we are not a CRA

Lodestone Data is not a consumer reporting agency, and nothing furnished here is a consumer report. Data may not be used to determine eligibility for credit, insurance, employment, housing, or any other FCRA-regulated purpose.

Those uses are not available as purposes and are refused if declared. For FCRA-compliant screening, use a consumer reporting agency.

Retention

• Search results are kept 30 days, then deleted automatically
• The search log (who, when, purpose, result) is kept longer: it is the compliance record
• The search log stores a hash of the subject, not the subject

What gets an account suspended

• Searches without an articulable permissible purpose
• Any FCRA-regulated use
• Stalking or harassment
• Searching a person who holds a protective order against the account holder
• Sharing credentials outside the credentialed entity
• Reselling access without a written agreement