Version 1.0 · Effective November 11, 2026 · authenticate.com/security-requirements · Prior versions
Part of the Authenticate Customer Agreement between Authenticating.com LLC and its customer (Customer Agreement, Section 1.2). Capitalized terms not defined here have the meanings given in the Customer Agreement. Prior versions are archived on this page.
For purposes of these Security Requirements, "Information" means any confidential information, Personal Data, reports, or Customer or End User information obtained from Authenticating.
Customer will:
Ensure that only Authorized Users can order or access the Information.
Ensure that Authorized Users do not order reports for personal reasons or provide them to any third party except as permitted by the Customer Agreement.
Ensure that all devices used to order or access the Services are placed in a secure location accessible only by Authorized Users, and are secured when not in use through screen locks or equivalent controls.
Prevent unauthorized ordering of or access to the Services by limiting knowledge of credentials to individuals with a need to know; promptly revoking credentials when an Authorized User no longer requires access or a credential may be compromised; enforcing multi-factor authentication for all access to the Services; and using all security features in the software and hardware used to access the Services.
Not use personal computer hard drives or portable or removable storage media to store Information. Store all printed Information in a secure, locked container when not in use, and destroy it when no longer needed by cross-cut shredding or an equally effective method.
When electronically sending, transferring or storing Information, encrypt it using at minimum AES-256, in transit and at rest.
Monitor compliance with these Security Requirements and immediately notify Authenticating on suspecting or learning of any unauthorized access or attempted access to the Services, including through review of each invoice for unauthorized activity.
Not ship hardware or software between locations or to third parties without deleting all Authenticating credentials and all Information.
Inform Authorized Users of the legal restrictions on use of the Services set out in Section 4 of the Customer Agreement, and of the civil and criminal liability that may attach to unauthorized access or misuse under 15 U.S.C. §§ 1681n, 1681o and 1681q.
Dispose of Information in accordance with Part 2 and with 15 U.S.C. § 1681w and 16 C.F.R. Part 682.
"User Information" means any record about an individual, in any form, that is a report or is derived from a report generated through the Services, including any compilation of such records and any personal identifying information.
Any person who maintains User Information for a business purpose must properly dispose of it by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. Reasonable measures include:
1) burning, pulverizing or shredding papers containing User Information so that it cannot practicably be read or reconstructed;
2) destroying or erasing electronic media containing User Information so that it cannot practicably be read or reconstructed;
3) after due diligence, contracting with a record-destruction business to dispose of material identified as User Information in a manner consistent with these Security Requirements; and
4) implementing and monitoring policies and procedures that protect against unauthorized or unintentional disposal of User Information.
This is the first published version of this document. When it is updated, prior versions will be archived here.