Under the Fair Credit Reporting Act, a background check is a consumer report. It is meant to be seen by exactly two parties: the organization that ordered it, and the person it's about. If you ever see something that looks like it crossed that line — one volunteer's email, portal, report, badge, or certificate appearing to show someone else's screening result or clearance — we want to hear about it immediately, even if you're not sure.
Tell us before you do anything else
What to send us
The details are much easier to capture while the message is still in front of you, so grab what you can before anything gets deleted:
| What we need | Details |
|---|---|
| Where you saw it | The email’s subject line and roughly when it arrived, or the exact screen in the dashboard or volunteer portal. |
| Who received it, or was looking at it | Their name and email address. |
| Whose information appeared | The other person’s name. |
| What was actually shown | A status or clearance? A name? A report? A badge? As close to the wording as you can manage. |
| A screenshot or forwarded copy | If you still have the message. Send it with the details intact — please don’t redact the names, because those are what let us trace it. |
What happens next
A person at ScreenForge Labs picks it up — not an automated reply. We pull the actual sent message and its delivery record, confirm what was rendered and who received it, and tell you what we found. If anything was disclosed that shouldn't have been, we'll tell you that plainly along with what we're doing about it. Every privileged action our staff take while investigating is written to an append-only audit log.
If you were mid-task, it’s fine to pause
Related things that are working as intended
Some of what people report turns out to be by design, and it's worth knowing the boundaries:
- A shared badge shows status only — active or expired and the validity dates, never the underlying report. See Share your badge.
- A volunteer's message email contains the message you sent them — that's intended, and it only ever contains your message to that volunteer. Anything about a different volunteer showing up there is not intended. See Message your volunteers.
- Only the organization that ordered a check can see the report, along with the volunteer it belongs to. Another organization never sees your report, and one volunteer never sees another's.
Looking for how we protect data generally — encryption, access controls, auditing? That's in our security posture. Found a vulnerability in the platform itself? Report it to the same address; our disclosure policy and safe-harbor commitment are at volunteerbadge.com/security.