The clients you check, the notes you keep and the reports you file are business information, and some of it is sensitive. Client data security at ClientVetter starts from a simple position: collect only what a client check needs, protect it in transit and at rest, show it only to the people who should see it, and delete it when it has no further purpose. This page describes how that works today, plan by plan, without marketing labels or badges we do not hold.
Every page, report, export and API call travels over HTTPS with modern TLS. Plain HTTP requests are redirected to the encrypted address, and session cookies are marked secure and HTTP only, so they are never sent over an unencrypted connection or read by scripts on the page.
Data at rest is encrypted as well. Account records, check results, monitoring settings and uploaded evidence files sit on encrypted storage, and backups are encrypted before they leave the server. Passwords are never stored in readable form: we keep only a salted, one-way hash, and the 6-digit signup codes are stored the same way and expire within minutes.
A check you run belongs to your account. Other members never see your checks, your clients or your notes, and the company you checked is not told about it. Shareable links on Team plans and above are long, unguessable addresses that you can revoke at any time.
Team, Agency and Enterprise accounts have roles. An owner manages billing and seats, admins manage members and settings, and members run checks and read reports. You decide who can submit non-payment reports, export PDFs or change monitoring, and removing a seat ends that person's access at once.
Inside the service, access to production systems is limited to the few administrators who operate it, uses individual credentials with two-factor sign-in, and is logged. Nobody browses customer reports out of curiosity, and support looks at an account only when you ask for help with it.
Firms that need to show who did what get a record of it. The audit log on Agency and Enterprise lists sign-ins, checks run, reports viewed and exported, non-payment reports submitted, role changes and seat changes, with the user and time for each entry. Admins can filter it and export it for their own records.
Enterprise adds SAML single sign-on, so members sign in through your identity provider and leave when your directory says they leave, and SCIM provisioning to create, update and remove seats automatically. Enterprise also includes priority support with a named contact and a data processing agreement. The full list by plan is on ClientVetter pricing.
| Control | Starter | Team | Agency | Enterprise |
|---|---|---|---|---|
| Roles | none | yes | yes | yes |
| Audit log | none | none | yes | yes |
| SAML SSO and SCIM | none | none | none | yes |
| Data processing agreement | none | none | none | yes |
The free preview on the homepage runs on public records only, and its result is kept for 30 days so the link you received keeps working while you decide. After 30 days the result is deleted automatically. Limits on previews per day are enforced with your IP address, which is kept for the same period.
Checks in a paid account stay in your history for as long as the account is active, so you can return to a report or compare it with a fresh check later. You can delete a report whenever you like. Deleting it removes the report from your history, but the check still counts toward your monthly usage, because the lookups already ran. When you close an account, its checks, notes and monitoring lists are deleted from live systems, and copies in encrypted backups expire on their normal rotation.
A non-payment report needs proof: a signed contract or accepted proposal, the unpaid invoice, and proof of delivery or correspondence. Those files are uploaded over an encrypted connection and stored encrypted, separately from the report text.
Other members never download your evidence. They see the published facts (amount band, dates, status) and the reported company's reply. The evidence files are read by our moderation team before publication, and during a dispute the parts needed to answer it are shared with the reported business, so it can respond to the actual claim. Reports appear only to logged-in paying members and are never public or indexed. The rules are set out in full on non paying clients, and a reported company can dispute a non-payment report at any time.
ClientVetter sets only the cookies the service needs to work: a session cookie that keeps you signed in, a security token that protects forms against forged requests, and a preference such as your billing view. There are no advertising cookies, no tracking pixels and no cross-site profiles, which is why there is no cookie banner. Details are in the privacy policy.
The safest data is the data we never collect. ClientVetter does not store home addresses, criminal records, family details or any private information about the people behind a business, because the product checks businesses and people only in their business role. The reasons are explained on the fcra compliant background check page.
If you find a security issue in ClientVetter, write to [email protected] with a description, the steps to reproduce it and the address affected. Please give us reasonable time to fix it before sharing details, do not access other people's data beyond what is needed to show the problem, and do not run tests that degrade the service for others. We confirm receipt, keep you informed while we work on it and tell you when it is fixed.
No. Checks, notes and monitoring lists are private to your account. Only non-payment reports, after moderation, are visible to other paying members.
No. Deleting a report removes it from your history, but the check still counts toward your plan's monthly usage. Limits reset each billing period.
We do not claim certifications we have not been awarded. This page describes the controls that run today, and Enterprise customers receive a data processing agreement.
Your preview stays private, runs on public records and is deleted after 30 days.
Your full report for this client is saved to your account.