Service agreement
1. Access to consumer reports
Information Direct grants you access to consumer reports upon successful completion of credentialing. Credentialing includes verification of business identity, permissible purpose, and compliance posture under the FCRA and applicable state laws.
2. Authorized setup assistance
If you submit an order intake or account setup request, you authorize Information Direct to use the business, billing, package, and authorization information you provide to prepare account setup, billing setup, order intake, and associated fulfillment portal entries on your organization's behalf. Information Direct will not submit consumer reports without a permissible purpose, required applicant authorization, and any additional documentation required by law or by the fulfillment platform.
3. Requesting reports
You agree to request consumer reports only after (a) obtaining written authorization from the consumer, (b) providing clear and conspicuous written disclosure that a consumer report may be obtained in a standalone document where required, (c) verifying that the purpose is a permissible purpose under 15 U.S.C. §1681b, and (d) completing any additional investigative consumer report or motor vehicle record authorization required by law.
4. Adverse action requirements
If adverse action is to be taken in whole or in part on the basis of a consumer report, you agree to follow the two-step process required by FCRA §1681b(b)(3): pre-adverse action notice with a copy of the report and a Summary of Rights, followed by final adverse action notice only after a reasonable period for the consumer to respond. Final notices must include the CRA contact details, required consumer dispute and free-copy rights, and any CFPB or agency contact information required by the current model notice or applicable law.
5. Ongoing obligations
You agree to maintain FCRA-compliant disclosure, authorization, and adverse action processes for the duration of this agreement. Information Direct may audit your compliance at reasonable intervals and may suspend service for non-compliance.
6. Confidentiality and client security duties
All consumer reports, applicant data, and related information are confidential. You agree to implement reasonable administrative, technical, and physical safeguards to protect consumer information from unauthorized access, use, or disclosure, including unique user access, prompt user deactivation when access is no longer needed, encryption or equivalent protection for stored copies, restricted access based on job need, and prompt notice to Information Direct of any suspected unauthorized access involving consumer information.
7. Secure disposal and FACTA
Downloaded reports, printouts, notes, and electronic copies containing consumer report information must be disposed of securely when retention is no longer required, consistent with the FACTA Disposal Rule and applicable state requirements. Acceptable methods include shredding, pulverizing, burning paper records, secure erasure, destruction of electronic media, or use of a qualified disposal vendor under confidentiality obligations.
8. Motor vehicle records and DPPA
If you request motor vehicle record services, you certify that the request has a permissible purpose under the Driver Privacy Protection Act and applicable state MVR rules, and that you have obtained any required written authorization from the individual.
9. Penalties and liability
Violation of the FCRA may result in civil liability under §1681o and §1681n, criminal liability under §1681q, and regulatory enforcement by the Federal Trade Commission, Consumer Financial Protection Bureau, or state attorneys general. You are solely responsible for compliance obligations applicable to your organization.