Due diligence
Sub-processors
Every supplier that touches a lender’s or a borrower’s data, what it receives, and where.
Before a new one, 30 days’ notice by email to every lender, here, and in the Atom feed. A lender that objects may end the agreement under its clause 11.2.
Follow changes in any feed reader. We keep no address.
On Creditcrest’s account
Cloudflare and Microsoft always. Each of the others only for its job, and only once that service is switched on for the lender.
| Supplier | What it does | Data it receives | Where | Account | When |
|---|---|---|---|---|---|
| Cloudflare | Runs the software and this website: hosting, network, storage, our email forwarding, and cookieless visit counts | Everything sent to the software, while it is handled; request logs (time, address, status) for 30 days; our invoicing counts; mail to our addresses, in transit | Global network, usually Australia for an Australian request; our storage is placed in Oceania. United States company | Creditcrest’s | Always |
| Microsoft | The mailbox our addresses (hello@, support@, security@, privacy@, legal@) forward to | Whatever you email us | Global. United States company | Creditcrest’s | Always |
| Resend | Sends email: codes and notices to applicants and borrowers, our alert emails, and this website’s enquiry form to us | The email address and the message | United States | Creditcrest’s | When email is on |
| Twilio | Sends text-message codes and notices | The mobile number and the message | United States | Creditcrest’s | When text messages are on |
| Didit | Checks ID documents, selfies and liveness, and screens sanctions and politically exposed persons lists | ID document and selfie images; the name and date of birth given | Spanish company | Creditcrest’s, or the lender’s own | When identity checks are on |
| Fiskil | Reads bank data with the applicant’s consent, under the Consumer Data Right | Name, email and mobile, to open the consent; the accounts, balances and transactions consented to | Australia | Creditcrest’s, or the lender’s own | When bank connection is on |
| Zepto | Pays out loans, checks the payee’s account name, and collects repayments by PayTo | The payee’s name, BSB and account number, and the amounts | Australia | Creditcrest’s, or the lender’s own | When payments are on |
On the lender’s own account
The lender’s own suppliers, not ours. The software reaches them for the lender, with the lender’s credentials.
| Service | What for | Where |
|---|---|---|
| The lender’s own database | Keeps the lender’s records: applications, loans, documents, identity results, the ledger | The lender’s own Cloudflare account |
| Credit reporting bodies (Equifax, Experian, illion) | Credit enquiries and the monthly reporting, run on the lender’s own agreement | Australia |
| illion BankStatements | Bank statements, if the lender chooses it: the applicant signs in to their bank on illion’s page. Not the Consumer Data Right | Australia |
| An outside e-signature service | Signs contracts instead of Creditcrest Sign, if the lender switches to one | The lender’s choice |
Changes
Fiskil named, Microsoft added, and what each supplier receives. Fiskil is named as the bank-data provider. Microsoft is added: it holds the mailbox our addresses have forwarded to since 26 September 2026, and was missing from this list. Each supplier now shows the data it receives, and the services a lender connects on its own account are listed apart, illion among them. This feed began.
Zepto added. Zepto added for payouts, the payee’s account-name check and PayTo repayments, when payments are on.
The list published. Cloudflare, Didit, Resend, Twilio and a Consumer Data Right bank-data provider listed, as identity checks, email, text messages and bank data were built.