Security at CreditScoreTeam
What we keep, where it lives, who can see it, and how to tell us about a problem. We publish this page instead of badges.
What we keep, and what we don't
We keep your email address, your province and language, and the reports you choose to save.
We never ask for your SIN, your card number or your bank login.
When we read your report for you, we read the PDF in memory and do not keep that copy. If you add a file to your documents, it is sealed like your reports.
Where it lives
Our server functions run in Montréal.
Our database is hosted by Supabase. We will name its country here once we have checked it.
How it is sealed
The reports you save are sealed with a strong lock (AES-256-GCM) before they reach the database. The key is not in the database.
Every page travels over a secure link (HTTPS), and no other site can show our pages inside its own.
Who can see it
You can see your saved reports. Our team can open your file to help you. Every look is logged and you can see the list in your Account.
Staff sign in with a link. They also set up a code from an app on their phone. After a 7-day start, staff pages need that code.
Each role sees only the screens given to it, and staff actions are logged.
How long we keep it
If you do not sign in for 24 months, we delete your account and your saved reports.
You can delete a report, or your whole account, at any time.
Where your data goes
These companies help us run CreditScoreTeam. This is what each one gets.
| Company | What it does for us | What it gets | Country |
|---|---|---|---|
| Vercel | Hosting: the website and the server functions | Every request to the site (pages and forms), with its IP address, in server logs | United States (our functions run in Montréal) |
| Supabase | The database | Accounts, saved cases (sealed), leads, staff records | To be confirmed (the project region) |
| Resend | Sending email | The email address and the text of each email we send | United States |
| Anthropic | The assistant and reading an uploaded report | Questions to Compass with personal details removed; the text of an uploaded report with personal details removed | United States |
| PostGrid | Mail it for me (registered mail), only when switched on | The letter a reader chooses to send, with the names and addresses on it | To be confirmed |
Tell us about a problem
If you think you found a security problem, write to security@creditscoreteam.com. Please do not test it on other people's accounts.
We keep a record of every incident. If one puts you at risk, we tell you directly.
Audits
SOC 2 (an outside audit): planned, no date yet. Until then, this page is how we show our work.
Privacy officer: to be published.