Nova Credit

Bureau relationships, aggregator coverage and consumer reporting agency status took years and licenses to build, and that access is the asset a better model cannot replicate. Models turn raw foreign files and transaction streams into risk attributes, but without them the data business survives, still translating foreign reports and delivering permissioned data through one integration.

The company states that clients approve, decline and send adverse action notices while it manages disputes, so it takes no credit decision itself. Nothing limits use of its attributes, sets a minimum human review before an adverse decision rests on cash flow signals or rules out any use case, though the same attributes feed tenant screening.

A miscategorized deposit becomes a wrong income figure, then a wrong debt to income ratio, then a declined application. No attribute level validation, categorization accuracy, sample period or drift reporting is published for a model risk function to review.

A major card issuer reported that accounts approved through this data were 79 percent less likely to become delinquent, a lender publishing performance on its own book. The president of a major issuer's branded cards business is quoted by name, and PayPal deployed Cash Atlas, the cash flow product, across its consumer credit portfolio.

The derived attributes and scores carry no model card, evaluation method or incident disclosure. A reserved right to develop new insights from data a person shared for one credit application describes secondary use with no published bound.

Collection happens only when a person chooses to share, inverting the default in a category built on data gathered without people's involvement. The privacy policy still reserves use of collected data for marketing and advertising, which sits uneasily beside that permissioned framing.

An information security policy built on an international standard, a certification against it and a SOC Type II attestation are each named in precise terms. No trust center, downloadable report or scope statement shows whether the data pipeline sits inside the certified boundary.

Operating as a consumer reporting agency under the Fair Credit Reporting Act (FCRA) brings accuracy duties, permissible purpose limits and exposure to regulators and private action, with published dispute machinery proving it operates. The status applies in certain jurisdictions only, and the coming consumer data access rule that will reshape permissioned data supply goes unaddressed.

Bank transaction data reveals remittances abroad, religious giving, benefits receipt and medical spending, all correlated with national origin, religion, disability or family status. Attributes built on it can reproduce protected attributes without naming them, and no disparate impact testing or explainability for adverse action reasons is published.

A consumer who thinks a report is wrong can dispute it with the company directly, which must investigate on statutory timelines, and the published process includes blocking adverse information for trafficking survivors. Lenders get no published terms, warranty or service level for a wrong attribute, mistranslated file or miscategorized transaction.

Every input arrives from outside: foreign data from bureaus in more than a dozen countries, domestic bank data from aggregators covering over 90 percent of banks, plus payroll and document sources. Individual aggregators are not named, so concentration cannot be assessed, and no technique or provider is disclosed for the categorization and scoring models.

Upstream, routing across bureaus, aggregators, payroll and document sources fails over between providers with different coverage and uptime. Downstream, no code, low code and full interface paths sit beside distribution through independent decisioning platforms, so a lender can add the data without touching its stack.

Taking a credit file from a bureau in one country and rendering it for a lender in another makes international transfer the product itself. Processing location, transfer mechanisms for restricted source countries and retention of translated files are all unpublished.

Implementation is claimed to run 9 to 12 months faster than building in house, with the replaced work named: bureau partnerships, data categorization and attribute construction. No price or unit is published, though distribution through third party decisioning platforms may carry its own terms.

Card issuers, global banks, digital lenders and property managers sit in a base of more than 5,000 businesses, since renting raises the same underwriting question as lending. The cross border product serves arrivals in the United States, United Kingdom and Canada among others, aimed at newcomers and the more than 45 million Americans without usable credit files.