Encryption in Transit & at Rest

Sensitive data is protected with modern encryption standards (TLS 1.2+ and AES-256).

Privacy First

We never sell your personal information. Ever.

FCRA-Aligned Practices

Our platform and letters are designed around FCRA requirements and industry best practices.

Secure Infrastructure

Hosted on trusted cloud infrastructure with modern encryption and access controls.

Continuous Monitoring

Our systems and access patterns are actively monitored so we can respond to issues quickly.

How we keep your information secure

End-to-End Encryption

All sensitive data is encrypted using industry-standard protocols (TLS 1.2+ and AES-256).

Strict Access Controls

Only authorized team members can access the information needed to serve you.

Regular Security Reviews

We perform continuous security testing and reviews to identify and fix issues.

Data Minimization

We collect only the information necessary to deliver our services and securely delete it when no longer needed.

Incident Response Plan

We maintain a documented incident response plan to protect you in the unlikely event of a security incident.

Review Our Privacy Policy

Transparent by design

Trust is earned through clarity. Here's how we make it easy to hold us accountable.

We're transparent

We believe trust is earned through transparency. If you ever have questions about how your data is used or protected, we're here to help.

Contact our security team

Your rights matter

You have the right to access, correct, or delete your personal information at any time.

Learn more about your privacy rights

What we do to protect you

A closer look at the eight pillars behind CreditLift's security and privacy posture.

1. Data Protection

Your information is protected end to end

We treat every piece of data you share with us as sensitive by default.

  • Encryption in transit with TLS 1.2 or newer between your browser and our servers.
  • Encryption at rest using AES-256 for databases, backups, and stored files.
  • Secure data handling — we scope access, log usage, and delete what we no longer need.
  • Sensitive document protection — credit reports and identity documents are stored in dedicated, access-controlled storage.

2. Account Security

Secure sign-in you can rely on

Your account is protected by modern authentication with defense-in-depth session controls.

  • Password authentication with strong-password enforcement (length, mixed case, digits, symbols).
  • Sign in with Google via Emergent-managed OAuth — no passwords transit our servers for social sign-in.
  • Session protection with signed, short-lived access tokens.
  • Refresh-token rotation on every renewal to invalidate stolen tokens.
  • Idle-timeout enforcement — inactive sessions automatically expire.
  • One-click logout and immediate session revocation on password reset.

3. Privacy

Your data belongs to you

We collect the minimum information required to run our service and use it strictly for the purposes you consent to.

  • Your personal information is never sold — full stop.
  • Access to consumer data is limited to authorized team members with a documented purpose.
  • Purpose-based data use — we only use your data for the features you've asked us to run.
  • Privacy controls — you can view, correct, and request deletion of your personal information at any time.

4. Document Security

Sensitive documents, carefully handled

Credit reports, identity documents, dispute letters, and bureau responses all live in access-controlled storage with audit logging.

  • Credit reports are stored per-user and are never shared between accounts.
  • Identity documents are scoped to verification workflows and access is logged.
  • Dispute letters are generated on demand and delivered only to you and the intended recipient.
  • Bureau responses are attached to the originating dispute and visible only to the account owner.
  • Controlled team access — support access requires an auditable reason.

5. Payment Security

Payments handled by Stripe

CreditLift never sees or stores your raw card details. Payment collection is handled entirely by Stripe.

  • Stripe processes all card transactions — a PCI DSS Level 1 certified processor.
  • Card details are entered inside Stripe's hosted elements, never on our servers.
  • We store only the transaction reference and status we need to serve you.
  • Secure checkout, refund flow, and dispute handling all go through Stripe's protections.

6. Mailing Security

Certified USPS mailing with tracking

Every dispute letter is delivered through a certified mailing partner so you have proof of delivery.

  • Certified USPS mailing — every letter has a tracking number and delivery record.
  • Integration with Click2Mail is scoped to the letter content and destination address for each dispute.
  • Tracking and mailing records are attached to the dispute in your account for full audit trail.
  • We never expose your personal information beyond what is required to complete the mailing.
LiftToken

7. LiftToken Wallet Security

A server-authoritative wallet you can trust

Your LiftToken balance is calculated on our servers from an immutable ledger — the client only ever displays what the server has computed.

  • Server-authoritative balances — the frontend never calculates or negotiates a balance.
  • Immutable transaction ledger — every credit or debit is recorded as an append-only event.
  • Idempotent credits and debits — safe against retries, double-charges, and network hiccups.
  • No client-calculated wallet balances — the wallet UI reflects the server's authoritative state.
  • Audit logging for every wallet action so we can trace and investigate any question you have.

8. Consumer Control

You're in the driver's seat

Nothing goes out on your behalf without your explicit action. Every step of the dispute process is transparent.

  • You choose exactly which items get disputed — nothing is auto-selected.
  • No automatic disputes are ever sent without an action you initiate.
  • Transparent status tracking on every dispute, from draft to bureau response.
  • Clear history of every action taken on your account, with timestamps.

We're committed to protecting your information and your future.

Secure platform. Transparent practices. Real results.

Get Started for Free