FCRA & Permissible Purpose

This page describes Customer obligations when using iStealth tools (including the launcher, browser, and the Enterprise-tier iData research module) to interact with services that provide or process consumer-reporting data, financial information, identity-verification scores, or similar regulated data. It is read together with our Terms of Service, Acceptable Use Policy, and Privacy Policy.

This notice is general informational material. It is not legal advice and does not create an attorney-client relationship. Customer must consult qualified counsel for advice on its specific circumstances.

iStealth’s products are general-purpose B2B software tools. They do not themselves constitute a consumer-reporting agency, do not maintain a consumer-reporting database, and do not furnish consumer reports as defined under 15 U.S.C. § 1681a(d).

When a Customer uses our tools to interact with third-party consumer-reporting agencies or identity-verification vendors (for example LexisNexis, Experian, TransUnion, Trestle, IDDataWeb, MicroBilt, Twilio Identity, Authenticate.com), the legal relationship is between the Customer and that vendor, governed by the Customer’s contract with the vendor and the vendor’s certifications under FCRA. FP System LLC is not a party to that relationship and assumes no responsibility for the Customer’s compliance.

FCRA § 604 (15 U.S.C. § 1681b) restricts when a consumer report may be obtained or used. Common permissible purposes include:

• Consumer-initiated transaction — the consumer requested a product or service that requires a credit, identity, or fraud check (loan application, account opening, lease, etc.).
• Review of an existing account — an account the consumer already holds with the Customer, for legitimate business purposes connected to that account.
• Written instruction of the consumer — the consumer signed a disclosure authorizing the inquiry.
• Employment purposes with separate consumer authorization (FCRA § 604(b)).
• Court order or federal grand-jury subpoena.
• Legitimate business need in connection with a transaction initiated by the consumer.

Customer is responsible for documenting which permissible purpose applies to each inquiry it conducts using iStealth tools, retaining FCRA disclosures and authorizations as required, and providing adverse-action notices to consumers when appropriate.

The iData module (available to Enterprise-tier subscribers) captures, replays, and fuzzes HTTP traffic that originates from the Customer’s authenticated browser session. Because every replayed or fuzzed request is sent from within the Customer’s own session, using credentials issued to the Customer (or that the Customer is otherwise authorized to use), the request inherits the Customer’s legal posture toward the receiving service.

The Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) restricts how non-public personal information held by financial institutions may be obtained and disclosed. When a Customer’s use of iStealth tools touches GLBA-protected data, the Customer is responsible for:

• Holding the GLBA-permitted relationship that authorizes the access (account servicing, fraud prevention, consumer-initiated transaction, etc.).
• Maintaining administrative, technical, and physical safeguards (Safeguards Rule, 16 C.F.R. Part 314).
• Honoring opt-out rights for non-affiliated sharing (Privacy Rule, 16 C.F.R. Part 313).

The Driver’s Privacy Protection Act (18 U.S.C. § 2721 et seq.) restricts the disclosure and use of personal information from motor-vehicle records. Customer must hold a permitted-use designation under 18 U.S.C. § 2721(b) for any inquiry that retrieves DMV-derived data.

In addition to federal law, several states impose stricter requirements on Customer use. Notable examples:

• California: CCPA / CPRA consumer-rights regime, separate from FCRA.
• Vermont: data-broker registration requirement (9 V.S.A. § 2446 et seq.).
• New York: SHIELD Act data-security obligations.
• Illinois: BIPA (biometric information privacy).
• Texas: identity-theft enforcement act and consumer-data-protection rules.

Customer is responsible for identifying every jurisdiction in which it operates and complying with the applicable state regimes.

For Enterprise-tier subscribers, FP System LLC retains server-side audit logs of iData replay, fuzz, and direct-query operations for ninety (90) days. Logs include license key, profile identifier, target hostname, operation type, and timestamp. Logs are retained for incident-response, fraud-prevention, and contractual-compliance purposes.

Customer may request an export of its own audit log at any time during the subscription term. These logs are not, and may not be relied upon as, evidence of the Customer’s permissible purpose — that documentation must be maintained independently by the Customer.

FP System LLC will not develop, sell, or operate:

• Bulk-enumeration tooling that targets consumer-reporting databases without a per-consumer permissible-purpose chain (for example, SSN-range scanning against credit-bureau APIs).
• Tools designed to bypass a financial institution’s terms-of-service or anti-automation defenses against unauthorized accounts.
• Identity-fabrication tooling, synthetic-identity generation, or any tool whose primary purpose is the evasion of know-your-customer requirements.
• Resale or productization of consumer data captured through Customer use of our tools.
• Custom features that, in our reasonable judgment, would primarily enable unauthorized access or evasion of regulated-data protections.

Requests for any of the above will be declined and may result in termination of the Customer’s subscription, retention of any unused fees, and referral to law-enforcement where appropriate.

The line between FP System’s responsibility and the Customer’s responsibility under this notice is summarized as:

Questions about Customer compliance obligations should be directed to the Customer’s own counsel.

Questions about iStealth’s tools, audit-log exports, or contractual matters can be directed to [email protected].