Compliance standards

Sourcing standards

A dataset enters our catalog only when all of the following are on file:

• A resale license. The provider's terms allow us to resell or sublicense the data for the uses we offer it for. Datasets licensed for internal use only are never resold.
• Provenance. For personal information: who collected it, how, and the consent or legal basis relied on, such as opt-in consent, public records, or notice with an opportunity to opt out.
• No prohibited categories. No precise geolocation of identifiable people, health, biometric, or genetic data, and nothing about anyone under 16.
• A recorded approval. Every purchase is approved by a named person before money is spent, and the decision is kept in our audit log.

Buyer screening

Every request is reviewed by a person before we quote or deliver anything. Buyers must:

• identify their organization and a business contact;
• state the country where the data will be used and describe the intended use;
• agree to our acceptable use policy and sign a data license agreement before delivery.

Requests for use in China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, or Venezuela are refused automatically, consistent with the U.S. Department of Justice Data Security Program (28 CFR Part 202). Requests that describe credit, employment, housing, or insurance decisions are flagged and declined.

Prohibited uses

Our data may not be used for eligibility decisions covered by the Fair Credit Reporting Act, for discrimination against protected classes, to locate, stalk, or harass anyone, to re-identify de-identified data, or for unsolicited calls, texts, or email that break consent rules. The full list is in our acceptable use policy. We end licenses that are misused.

Consumer rights

• Opt-outs of sale and sharing take effect the moment they are submitted.
• Access, deletion, and correction requests are answered within 45 days, with a tracked due date for every request.
• Opted-out and deleted people are added to a hashed suppression list that is checked before every delivery, including data bought later.
• California residents can use the state's DROP platform; we process its deletion requests on the legally required schedule.

Make a privacy request or read our privacy policy.

Security

• Data is encrypted in transit and at rest, with continuous backups.
• Access to systems is limited to authorized staff and scoped service accounts with least-privilege permissions.
• Administrative actions, including purchases, publications, and privacy request decisions, are recorded in an audit log.
• Buyers receive only the fields and records covered by their license.

Registrations

AEVI Data is completing data broker registration with the California Privacy Protection Agency, the Texas Secretary of State, the Vermont Secretary of State, and the Oregon Department of Consumer and Business Services. Registration numbers will be listed here once issued.