Background checks with the subject’s signature. Nobody gets checked who didn’t sign.
How it works
1You request and certify a lawful, supported purpose.
2The subject sees exactly who is asking and signs — or nothing runs.
3Both sides receive the same public-source report.
Vouch checks public web and profiles, public records mentions, domain data, and breach-exposure metadata. It never seeks addresses, phone numbers, SSNs, private accounts, breach contents, or location data.
Request a consented check
Hard stop: that purpose requires a certified consumer reporting agency. Vouch doesn’t offer eligibility screening, and no request will be created. See lawful pathways.
Shown to the subject as who the check concerns, and the only name ever included in webhook payloads.
Vouch POSTs metadata-only events (signed / ready / revoked / deleted) to an https URL. A per-check webhook secret is shown once at creation; signatures are HMAC-SHA256 keyed by the SHA-256 hex of that secret (header X-Vouch-Signature). Report contents are never sent.
Requester Certification
Links created
Save both links now. For security, the subject consent link cannot be recovered later from the requester page; the database stores only hashes of both tokens.
The subject has 7 days to sign. If they sign, the report becomes available on both links and stays valid for 30 days.
Check your own footprint — the free front door
Run the exact same flow on yourself: you are both the requester and the subject. You certify below, you get the consent link, then you open it and sign as the subject. Nothing is different because it's you — that is the point of consent-first.
Your self-check is ready to sign
Connect & share Vouch
Put consent-first checks into your own tools and pages. Consent stays per-check and per-purpose everywhere below — an API key or a standing page never carries a reusable consent. The subject always sees the full disclosure and signs for that one check.
1 · API key — create checks from your own code
Register once (name/org + the same Requester Certification). The key is shown once; Vouch stores only its SHA-256 hash. Then POST /api/connect/create-check with header X-Vouch-Key returns {check_id, consent_url, requester_url}.
2 · Standing request page + embed kit
A standing page is a public link with your name/org prefilled. Anyone opening it can start a check under your registration; the subject still gets the full disclosure and signs per check. An optional webhook URL on the page receives the same metadata-only events for checks started there.
3 · Webhook events
Events: check.signed, report.ready, check.revoked, check.deleted. Payload is JSON metadata only: event, check_id, status, the subject name you supplied at creation (or null), purpose category, timestamp. Never report contents, never subject-supplied identifiers. Verify deliveries with header X-Vouch-Signature: sha256=<HMAC-SHA256 of the raw body, keyed by the SHA-256 hex of your webhook secret>. Delivery is best-effort; test receivers can use the built-in echo endpoint POST /api/webhook-echo/<any-id> on the API host.
Request a Vouch check
Loading…
Vouched
Loading…
Your requested check
Loading…
Consent to a public-source check
Loading…
Operator ledger
Metadata only: requester, subject name, purpose category, status, and timestamps. Report contents never appear here.
Forms & paperwork pack
Plain-language documents used by Vouch. Download them, print them, or read them in the browser.
Disclosure & Authorization
The subject-facing promise: what is checked, what is never included, and the subject’s rights.
Jobs, housing, credit, and insurance screening belongs with a certified consumer reporting agency. That route requires a permissible purpose, a standalone subject disclosure, written subject authorization, accuracy and dispute procedures, and decision notices where the law requires them. Vouch does not offer it.
Credentialed data providers
Large restricted-data platforms credential the buyer: registered business, documented statutory purpose, contracts, security review, possible inspection, and audits. A general desire to look people up is not enough.
Licensed private investigator
For lawful locating, litigation support, or fraud investigation, a state-licensed investigator may have regulated methods and duties. Verify the license and ask about sources and legal basis.
Your own records
You are always the subject of your own file. Use your legal disclosure and correction rights, review your own reports, and correct errors at the source. Vouch’s own-footprint purpose and Breach Check can help map public exposure.
Verified Consent (IDV) — future tier
Identity-verification platforms (the Persona / Veriff / Trulioo class) let the subject prove they are the signer — their own government ID plus a liveness check — inside the consent flow, before anything runs. That makes a Vouch signature much stronger: not just a typed name, but a verified person consenting. It requires a business account with the provider and per-verification pricing, so it is the documented paid upgrade path for Vouch — not built today. The consent-first flow above works without it; IDV would strengthen the signature, never widen what gets checked.
What Vouch deliberately does not connect
No data-broker APIs (the PeopleDataLabs / BeenVerified / Whitepages class), no people-search sites (PeopleFinders class), no breach-content lookup services (DeHashed class), no OSINT leak-database modules, and no third-party financial lookups. Those products trade in non-consented data; connecting them would break the one rule Vouch exists on — nobody gets checked who didn’t sign.