Delegate does not take custody of customer data.

This website

The contact form collects a name, institution, role, work email, and an optional message, and sends them to Delegate by email. The newsletter form collects an email address. Both are processed by Netlify, which hosts this site. There is no analytics script, no advertising pixel, and no third-party tracker on any page.

The site accepts no file uploads of any kind. Do not put customer data in any form on this site.

A DoubleCheck engagement

The engine runs on equipment the institution controls. The de-identified extract, the engagement salt, and the engine's working files stay on the institution's machines for the entire engagement. There is no upload step and no transmission back to Delegate.

Identifiers are replaced with a salted SHA-256 hash on the institution's side before analysis. Delegate never receives the salt.

What is excluded

Names, Social Security numbers, dates of birth, addresses, phone numbers, email addresses, account and routing numbers, SAR and other BSA/AML material, and consumer bureau data are excluded by agreement and blocked by the extraction script, which passes through only whitelisted columns and hard-fails on a column name that looks like any of them.

Roles

The institution determines the purpose and means of the processing. Delegate acts as a service provider under a written data processing agreement that sets scope, permitted purpose, handling, and destruction. Under GLBA, a financial institution may disclose nonpublic personal information to a service provider to prevent actual or potential fraud.

Retention and destruction

The de-identified extract and the engine's working files are destroyed within thirty days of the readout. Because the data never left the institution's machines, the institution performs and verifies the deletion. Delegate cannot attest to it. Contact-form correspondence is kept as ordinary business email.

Subprocessors

Netlify hosts this website and processes form submissions. Delegate's business email is hosted by a commercial provider. No subprocessor receives institution extract data, because no extract data leaves the institution.

What this is not

DoubleCheck output is not a consumer report, and Delegate is not a consumer reporting agency. The output contains no numeric scores and no dollar figures, and it does not make a lending, credit, or eligibility decision. The institution retains sole decision authority.

Contact

Questions about this notice, including the full technical data specification: leocohen@testdelegate.com.