Security by architecture, not by policy.
DoubleCheck is architected so institution data never enters Delegate's custody. The protection lives in the data flow itself, not in a promise. Here is exactly how.
On premises. Only the memo exits.
The engine runs on a machine you control, inside your environment. It reads the extract, replays the histories, and writes the findings memo locally. The only artifact that leaves is the memo you have read: dispositions and reason codes, no raw records.
One-way hashing. The salt stays with you.
Member, account, and counterparty identifiers are replaced with
SHA-256(salt + value) before anything is analyzed. The
engagement salt is generated on your side and written to a local file that
never leaves your institution. Without it the hashes cannot be reversed or
linked back to a member.
A scoped pull, not your whole book.
The extract covers flagged and charged-off accounts and the history needed to review them, not your entire membership. You set the scope before anything is generated.
PII, SAR, and bureau data are excluded.
Names, SSNs, dates of birth, addresses, phones, emails, SAR material, and bureau data are excluded by contract and blocked in the extraction script. The script passes through only whitelisted columns and hard-fails if a column name looks like PII or SAR material.
The output suggests. It never decides.
DoubleCheck returns pass, review, or fail plus reason codes. It is not a consumer report and not a consumer reporting agency. It produces no scores and no dollar figures. Your institution retains sole decision authority.
Thirty-day destruction, verified by you.
The de-identified extract and working files are destroyed within thirty days of the engagement, and the destruction is verifiable by your own IT because the data lived on your machines the whole time.
A diligence team is welcome to walk the extraction script and the data flow line by line. Request a review →