ScoreReform processes account details, user-supplied credit-report information, encrypted documents, disputes, plan tasks, provider authorization records, and AI conversations to provide its credit-organization software.
Security and separation
Records are tenant-scoped to the authenticated user. Uploaded documents are encrypted at rest with AES-256-GCM. Passwords and recovery codes are one-way hashed. Two-factor authentication is available to every customer and required for administrators.
AI processing
ScoreReform AI uses a privately hosted model. It receives normalized, tenant-scoped workspace context and not provider credentials, full account numbers, or raw provider payloads.
Retention and control
Active-account information is retained while needed to provide the service. Expired authentication records are eligible for routine deletion. Customers can export their account data, delete uploaded files, revoke provider authorization, or permanently delete their live account in Settings. Deleted live data may remain in encrypted disaster-recovery backups until those backups expire under the operational rotation.
Provider access
Credit data is accessed only after an explicit authorization workflow is enabled and accepted. Sandbox data is synthetic and visibly separated. Live bureau access remains disabled until provider and compliance approval.
Contact
Privacy requests: privacy@scorereform.com. Customer support: support@scorereform.com.