How ResidenceProof is built to withstand audits
The items below describe our intended operating controls. Regulatory badges such as FCRA-aligned practices and SOC 2 Type II are shown only after legal review and completed audits — all figures and certifications on this site are illustrative placeholders.
§ Permissible purpose
Every case must declare a permitted purpose before submission. A Super Admin controls which purposes each client organization may use, and a case cannot proceed without one.
§ Consent-first verification
No work begins until the subject signs electronic consent. Consent text, signature, timestamp, and IP are stored immutably, and the declared address and roster lock as a read-only snapshot.
§ Chain of custody
Every signal and field visit is logged with source, result, and retrieval time. Reports store the exact evidence snapshot used, so findings are reproducible under audit.
§ Consumer disputes
Subjects may dispute any report by ID with an identity check. Each dispute receives a number, a reinvestigation deadline (default 30 days), and a written outcome sent to subject and client.
§ Adverse action support
When a client indicates a decision relied on a report, the system generates an adverse-action notice template including our contact details and the subject's right to dispute.
§ Data minimization & certified purge
Each case type collects only required fields. Data is purged on a configurable schedule per client policy, and each purge produces a downloadable purge certificate.