Security
Security posture
Last updated: September 8, 2026. Draft pending counsel.
BGScreen processes consumer identifying information for FCRA customers. This page is a summary for technical reviewers. A questionnaire response is available from security@limelyte.com. We do not claim SOC 2 on this page.
Isolation
Each customer’s applicant files, orders, findings, and transaction log live in a dedicated PostgreSQL schema. Platform registry tables stay shared. Tenant identity comes from the request, not from a client-supplied body field.
Encryption
Social Security numbers and dates of birth are stored with AES-256-GCM. Ciphertext is bound to tenant and column. Search uses a keyed HMAC, not a bare hash of the number. Production refuses to start without encryption keys.
Transaction log
Every outbound vendor exchange is written once when it terminates. The database rejects updates and deletes on that table. Retention is by dropping an expired month, not by editing rows. The same log is the billing source of truth.
Authentication
People use session tokens. Machines use OAuth 2.0 client credentials and a short-lived access token. API clients do not store vendor bureau passwords. Product access and permissible purpose are resolved on every request.
Contact
security@limelyte.com
Limelyte Technology Group, Inc.