How Report Card handles your information
Last updated October 18, 2026
Who can use it
Report Card is a private, invite-only preview. Accounts are created only from an invitation, and the service isn't sold or advertised.
What we keep about you
- Your account: your name, email address and role. Your password is stored only as a one-way hash, so no one can read it, including us.
- What you enter: your vendor list, notes, engagement answers and review decisions. These are private to your account and aren't shown to other accounts.
- One cookie that keeps you signed in. Your light or dark display setting is kept in your own browser.
There's no advertising, no analytics or tracking scripts, and no third-party cookies. We don't sell or share account information.
What Report Card reads
Reports are built from published records about organizations: government sanctions and exclusion lists, SEC filings, breach notices filed with regulators, vulnerability catalogs, court and agency notices, public DNS and certificate logs, and the organizations' own public web pages. Report Card doesn't buy data about people, and it doesn't test or probe anyone's systems.
A name appearing on a public list is not a finding: possible matches are held for a person to review.
Security
- All traffic is encrypted (HTTPS).
- Invitation and password-reset links work once and expire after 72 hours.
- Each account's own information is kept separate from every other account's.
Keeping and deleting information
Account information is kept while the account is active. To have your account and what you entered deleted, ask the administrator who invited you.
Not a consumer report
Report Card grades organizations, not individuals. It is not a consumer report and must not be used for decisions about credit, employment, insurance or tenancy.