Effective July 26, 2026

Decipher Credit Solutions, Inc. (‘Decipher,’ ‘we,’ ‘us,’ or ‘our’) provides cloud-based B2B origination and underwriting software used by commercial lenders and other financial-services organizations.  

This Privacy Policy explains how Decipher collects, uses, protects, retains and deletes personal information through our websites, software platform, integrations, and other services that link to this Policy (collectively, the ‘Services’). It also explains choices and rights that may be available to individuals.

Decipher generally provides the platform to business customers. When we process applicant, borrower, company, guarantor, customer, employee, contact, communication, document, financial, or other information on behalf of a Decipher customer, that customer generally determines why and how the information is processed. In that context, Decipher acts as a service provider or processor. For information we collect for our own business purposes—such as website, account-administration, sales, billing, and security information—Decipher may act as a business or controller.

1. Scope of This Policy

This Policy applies to information processed through the Services and to interactions with Decipher’s websites, sales, account administration, customer support, and authorized integrations. It does not govern the independent privacy practices of Decipher customers or third-party services. Those organizations may provide separate privacy notices that apply to their collection and use of information.

2. Information We Collect

Depending on how the Services are used, we may collect the following categories of information:

Account and business contact information

• Name, job title, company, business address, email address, telephone number, username, and account preferences.
• Billing, subscription, contract, customer-support, and relationship-management information.
• Authentication information, single sign-on identifiers, multi-factor authentication status, and permissions.

Applicant, borrower, guarantor, and transaction information

• Contact, ownership, employment, business, and organizational information.
• Credit application information, certifications, consents, notes, tasks, decisions, and workflow records.
• Financial statements, tax documents, accounting information, receivables, payables, inventory, cash-flow data, and supporting documentation.
• Corporate identity-verification, fraud-prevention, KYB/KYC, sanctions-screening, UCC, corporate-registration, and similar information obtained through customer-selected services.

Documents and communications

• Documents, images, forms, attachments, electronic signatures, and information extracted or generated from them.
• Emails and other communications, including sender and recipient information, subject lines, timestamps, message content, attachments, and communication activity.
• Support requests, feedback, meeting notes, and other communications with Decipher.

Connected-account and integration information

When a user or customer connects Google Workspace, Microsoft 365, a bank, accounting platform, CRM, credit bureau, document provider, servicing platform, or another third-party service, Decipher may receive information authorized by the user, administrator, applicant, or customer. Users normally authenticate directly with the third-party provider. Decipher does not receive or store the user’s password for that provider, but may store encrypted OAuth tokens, access tokens, refresh tokens, connection identifiers, and related information needed to maintain the authorized connection.

Technical, usage, and security information

• IP address, browser type, device and operating-system information, referring URLs, and general location inferred from IP address.
• Login activity, feature usage, event records, audit logs, access history, error logs, performance data, and security alerts.
• Cookies and similar technologies used for authentication, preferences, security, analytics, and website operation.

Information from other sources

We may receive information from Decipher customers, authorized users, applicants, service providers, public records, business partners, credit and identity providers, and other sources permitted by law. The customer or party providing the information is responsible for having the authority and providing any notices or obtaining any consents required to submit that information to Decipher.

3. How We Use Information

We may use information to:

• Provide, configure, operate, maintain, secure, and support the Services.
• Create and administer accounts, authenticate users, manage permissions, and maintain audit trails.
• Support applications, underwriting, credit analysis, decisioning, closing, monitoring, customer communications, and related customer workflows.
• Receive, process, classify, validate, extract, organize, summarize, display, and associate documents and data with authorized records.
• Enable user-requested email and communication features, including sending, receiving, replying to, forwarding, synchronizing, displaying, searching, and associating business communications.
• Connect to and exchange information with customer-selected integrations.
• Provide customer-requested automation and artificial-intelligence features.
• Detect, prevent, investigate, and respond to fraud, abuse, security incidents, service disruptions, and technical problems.
• Provide support, training, implementation, billing, account management, and service communications.
• Improve the reliability, usability, security, and performance of the Services.
• Comply with contracts, legal obligations, regulatory requirements, court orders, and valid legal processes.
• Establish, exercise, or defend legal claims and protect Decipher, our customers, users, and others.

We access connected-account information only for features enabled or authorized by the user, the user’s organization, or the applicable Decipher customer. We do not use connected Google or Microsoft mailbox data for unrelated advertising, data brokerage, or generalized model training.

4. Google Workspace and Gmail Integration

Decipher offers an optional Google Workspace integration that allows an authorized user to connect a Google account to Decipher through Google OAuth. The integration requests only the Gmail permissions required to provide the enabled features: gmail.send, which allows a user to send email from Decipher through the user’s connected Google Workspace mailbox, and gmail.readonly, which permits Decipher to retrieve authorized email content without modifying, deleting, archiving, labeling, or changing the read status of messages in Gmail.

Information accessed

Depending on the permissions granted and features enabled, Decipher may access the user’s Google account identifier, name, profile information, and email address, as well as Gmail sender and recipient information, subject lines, timestamps, message and thread identifiers, message bodies, and attachments. Decipher retrieves and stores message bodies and attachments only when an email address associated with the message already appears on a record previously entered in Decipher by an authorized user. Decipher does not retrieve, save, or retain messages that are not associated with an existing Decipher record.

How the data is used

Decipher uses authorized Google user data only to provide the user-facing email functionality requested by the user or the user’s organization. This includes allowing an authorized user to compose and send business email from within Decipher through the user’s connected Google Workspace mailbox and retrieving incoming or outgoing business correspondence only when the message is associated with an email address already linked to an existing contact, company, lead, applicant, credit application, or other authorized Decipher record. Matching correspondence may be displayed, recorded, searched, and associated with that record. Messages that do not match an existing record are not retrieved, saved, or retained by Decipher.

Gmail notifications

Decipher may register a Gmail mailbox watch and receive mailbox-change notifications through Google Cloud Pub/Sub. A notification indicates that a mailbox change occurred; it does not contain the complete email. Decipher then uses the Gmail API with read-only access to determine whether the message is associated with an email address on an existing Decipher record. Decipher retrieves and stores the message body and attachments only when that association exists.

Limited Use commitments

Decipher’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Decipher does not use Google user data:

• To serve advertisements or create advertising or marketing profiles.
• To sell, rent, or transfer the data to data brokers.
• For unrelated surveillance or monitoring.
• To train generalized artificial-intelligence or machine-learning models made available to unrelated customers or third parties.
• For a purpose unrelated to providing, securing, maintaining, or improving the user-facing Google integration.
• To make independent credit or lending decisions outside the customer-requested Decipher workflow.

Human access

Decipher personnel do not access Google user data except when necessary to provide a user-requested feature, provide support with the user’s permission, investigate a security or technical issue, comply with applicable law, or perform internal operations consistent with the Google API Services User Data Policy. Access is limited to authorized personnel with a business need and is subject to confidentiality and security controls. Google-derived data is stored securely within Decipher’s Amazon Web Services environment.

Disconnecting Google

A user or authorized administrator may disconnect Gmail at any time through Decipher, and a user may also revoke Decipher’s access through the user’s Google Account permissions. Disconnection or revocation stops future access and synchronization under that authorization. Decipher retains previously synchronized email information while the user maintains a valid and authorized Decipher account, subject to the applicable customer agreement and Decipher’s retention policy. User data is deleted in accordance with Decipher’s retention policy and applicable legal, contractual, security, backup, and audit requirements. Deletion requests may be submitted as described in Section 10.

5. Microsoft and Other Email Integrations

When a user connects Microsoft 365, Outlook, Exchange Online, or another email service, Decipher accesses data only through permissions approved during that provider’s authorization process. Decipher may use authorized email data to send or synchronize messages, display correspondence, and associate message bodies and attachments only with existing Decipher records that contain an email address previously entered by an authorized user. Messages that are not associated with an existing record are not retrieved, saved, or retained. Users may disconnect Microsoft email or another connected email service at any time. Google and Microsoft mailbox data is not used for advertising, data brokerage, unrelated credit decisions, or training generalized models for unrelated customers.

6. Financial, Accounting, Identity, and Other Integrations

Decipher may use customer-selected providers to obtain bank, accounting, identity, credit, corporate-registration, sanctions-screening, document, CRM, servicing, and other information authorized by a user, applicant, administrator, or customer. The information is used to provide the applicable application, underwriting, verification, fraud-prevention, monitoring, communication, or workflow feature. Users may disconnect Quickbooks any other connected service at any time. Decipher does not sell connected financial or accounting information.

7. Artificial Intelligence and Automated Processing

Decipher may use artificial intelligence, machine learning, and automated processing for certain platform features, such as classifying documents, extracting information, identifying missing information, detecting inconsistencies, producing draft content, and supporting customer-configured workflows. As of the effective date of this Policy, Decipher does not use artificial intelligence to process Google-derived data. If this practice changes, Decipher will update this Policy and provide any notices or obtain any permissions required by applicable law or provider requirements.

Decipher does not use Google or Microsoft mailbox data to train generalized models for unrelated customers, for advertising, for data brokerage, or for unrelated credit decisions. AI-generated or automated outputs from other Decipher features may be incomplete or inaccurate and should be reviewed by an authorized person before being used for a material lending, credit, legal, regulatory, or compliance decision. Decipher’s tools support human review and do not replace a customer’s independent judgment or legal obligations.

8. How We Disclose Information

We may disclose information in the following circumstances:

• To the Decipher customer that controls the applicable account and to its authorized users.
• To service providers and subprocessors that host, secure, maintain, support, analyze, or provide the Services on Decipher’s behalf.
• To customer-selected integrations and third parties when requested or authorized by the customer, user, or applicant.
• To professional advisers, auditors, insurers, and financing sources subject to appropriate confidentiality obligations.
• When required by law, regulation, subpoena, court order, or other valid legal process.
• To investigate or prevent fraud, misuse, cybersecurity incidents, threats, or violations of law or contract.
• In connection with a merger, financing, acquisition, reorganization, sale of assets, or similar transaction, subject to appropriate protections.

Service providers may process information only to perform services for Decipher and must protect the information under appropriate contractual, confidentiality, and security obligations. Decipher does not sell personal information or connected-account data. We do not use connected email or financial data for targeted or cross-context behavioral advertising.

9. Security

Decipher maintains administrative, technical, physical, and organizational safeguards designed to protect information. These safeguards may include encryption in transit and encryption of sensitive information at rest, role-based and least-privilege access controls, tenant-level data separation, protection of OAuth tokens and credentials, security monitoring, logging, audit trails, vulnerability management, backups, incident-response procedures, employee confidentiality obligations, and vendor-security requirements.

Decipher hosts its cloud platform using Amazon Web Services. Google-derived data, Microsoft mailbox data, and other connected-service data retained by Decipher are stored securely within Decipher’s AWS environment and protected by Decipher’s administrative, technical, physical, and organizational safeguards. Decipher maintains a security program designed around recognized industry standards, including applicable SOC 2 controls. No method of transmission, storage, or security is completely secure, and Decipher cannot guarantee absolute security. Users should promptly report suspected unauthorized access or security incidents.

10. Data Retention, Disconnection, and Deletion

Decipher retains user data, including synchronized email information and connected-service data, while the user maintains a valid and authorized Decipher account and as otherwise required by the applicable customer agreement and Decipher’s retention policy. Decipher may also retain information as reasonably necessary to maintain application, borrower, communication, audit, security, and compliance records, resolve disputes, enforce agreements, and comply with legal obligations.

Users may disconnect Gmail, Microsoft email, Plaid, Quickbooks or any other connected service at any time. When an integration is disconnected or authorization is revoked, Decipher stops obtaining new information under that authorization and deletes, disables, or renders the applicable token unusable in accordance with operational and security procedures.

Previously synchronized information may remain while the user maintains a valid and authorized Decipher account or when it forms part of a customer-controlled record, communication history, audit trail, legal hold, backup, or required retention period. User data is deleted according to Decipher’s retention policy. Information retained solely in backups is removed or overwritten through Decipher’s normal backup-retention cycle, unless a longer period is required by law or for security and disaster recovery.

Users may request deletion through their organization’s Decipher administrator or by contacting Decipher using the information in Section 16. Because Decipher generally processes platform data on behalf of customers, Decipher may refer the request to, or require authorization from, the applicable customer. We may retain information when necessary to comply with law, prevent fraud, maintain security, resolve disputes, or enforce agreements.

11. Privacy Rights and Choices

Depending on applicable law and the context in which Decipher processes information, individuals may have rights to request access, correction, deletion, portability, restriction, or objection; to withdraw consent; or to appeal a decision concerning a privacy request. These rights may be subject to exceptions and verification requirements.

When Decipher processes information on behalf of a customer, requests concerning that information should generally be directed first to the customer that collected or controls the information. Decipher will assist customers with verified requests as required by contract and applicable law.

Individuals may opt out of non-essential marketing communications by using the unsubscribe instructions in the communication. Operational, security, billing, and service-related messages may still be sent when necessary.

12. Cookies and Website Technologies

Decipher and its service providers may use cookies, pixels, local storage, and similar technologies to authenticate users, remember preferences, secure the Services, understand website and platform usage, measure performance, and improve functionality. Browser settings may allow users to block or delete cookies, but some Services may not function properly without required cookies.

13. Customer Responsibilities

Decipher customers are responsible for:

• Providing required privacy notices and obtaining necessary permissions, authorizations, and consents.
• Ensuring they have the right to submit, access, use, and process information through Decipher.
• Managing user roles and permissions and removing access when it is no longer needed.
• Configuring integrations, workflows, and retention settings appropriately.
• Responding to privacy requests for customer-controlled information.
• Using information and Decipher outputs in compliance with applicable lending, credit, privacy, employment, consumer-protection, and other laws.

14. Children’s Privacy

The Services are business products and are not directed to children. Decipher does not knowingly permit children under 13 to create Decipher accounts or connect personal accounts to the Services. If Decipher learns that it collected personal information directly from a child in a manner prohibited by law, it will take appropriate steps to delete it.

15. Changes to This Policy

Decipher may update this Privacy Policy as the Services, integrations, business practices, or legal obligations change. The revised Policy will be posted on this page with an updated effective date. Material changes will be communicated when required by law, contract, or applicable provider requirements.

16. Contact Us

Questions, security reports, and privacy requests may be submitted to: