CreditDecide handles sensitive financial data. Security, isolation, and auditability are designed in from the data layer up — not bolted on.
Every record is scoped to an organization. Row-Level Security enforces isolation at the data layer — one tenant can never read or mutate another's data.
Provider credentials (Experian, TrueLayer) are stored per-organization and used only for outbound calls. Secrets are never returned in full by the API.
API keys are SHA-256 hashed at rest; the full key is shown once at creation. Keys are environment-scoped (sandbox vs production) with granular scopes.
Every request carries a request_id and is logged with actor, endpoint, and outcome — giving lenders a defensible record of who decided what, and why.
Sandbox and production data never mix. Test with synthetic data, then promote to live with a production key and your own provider credentials.
Each recommendation is backed by an evidence graph — every risk signal traces to its source document and confidence score. No black-box overrides.
Because CreditDecide supports credit decisions, every recommendation is policy-first, evidence-referenced, and fully auditable. No black-box overrides.
Lender policy is evaluated before any AI recommendation — the AI never silently overrides policy.
Every risk signal traces back to its source document, field, and confidence score through the evidence graph.
Recommendations ship with a referenced memo — positive signals, risk factors, and the policy outcome that informed them.
Signals that breach policy thresholds route to a human underwriter for review before a final decision is made.
When a final decision differs from the recommendation or policy, an override reason is required and recorded.
Every decision — automated or human — is logged with actor, timestamp, policy version, and outcome.
Post-decision outcomes feed back into calibration, so policies and models improve against real repayment behaviour.
“AI shouldn't just make a decision. It should show why the decision was made, what evidence supported it, which policy was applied, and who ultimately approved or overrode it.”
We work with lenders and fintechs on data processing agreements, penetration testing, and onboarding reviews. Start building in the sandbox, then request a security package when you're ready for production.