> ## Documentation Index
> Fetch the complete documentation index at: https://faq.universalaccountservicing.com/llms.txt
> Use this file to discover all available pages before exploring further.
# How we protect your information
> What we store, what we never store, who we share information with, and how to protect your own account.
The short version: we hold enough to service your account, we do not hold your full card or bank
numbers, and the parts that matter most are protected by something only you know.
## What we store, and what we never store
| | |
| ---------------------------------------------------------------- | ------------------------------------------------------------------ |
| **Your full card number** | **Not stored** in uPortal360. Only the last four digits are shown. |
| **Your full bank account number** | **Not stored** in uPortal360. Only the last four digits are shown. |
| **Your security code (CVV/CVC)** | **Never stored**, anywhere in our systems. |
| Your name, address, phone and email | Stored — we need them to service and contact you |
| Your Social Security number and income | Stored, from your application |
| Your balances, payment history, credit history and credit scores | Stored |
This is why someone who got into your account still could not take your card details: they are not
there.
## What protects your account
Three separate things, and an intruder would need all of them:
Assigned by us. Not guessable, and not derived from your name or date of birth.
Also assigned by us, numeric and long. It cannot be changed online — see
[Access Code security](/signing-in/new-access-code).
Your date of birth, or the last four digits of your Social Security number. This is never
printed on your statement.
**Your statement carries the first two.** Your Account Number and Access Code are printed on it,
so treat a paper statement the way you would treat a bank letter — keep it somewhere sensible and
shred it rather than putting it in the bin.
It is not enough on its own to open your account. It is two of the three.
You can also set a **secret passphrase** we ask for when you contact us — see
[Account access and security](/signing-in/account-access-and-security).
## Who we share your information with
Some sharing is how the account works, and you cannot limit it. Some we do not do at all.
| | Do we share it? | Can you limit it? |
| --------------------------------------------------------------------------------------------------- | --------------- | ----------------- |
| To run your account — process payments, respond to court orders, report to credit bureaus | Yes | No |
| With the retail seller or service provider where you used your account, and their related companies | Yes | No |
| For our own marketing | Yes | No |
| For joint marketing with other financial companies | Yes | No |
| With our affiliates, about your transactions and experiences | Yes | No |
| With our affiliates, about your **creditworthiness** | **No** | — |
| With our affiliates so they can market to you | **No** | — |
| With unrelated companies so they can market to you | **No** | — |
Our affiliates include sales finance and debt collection companies. Unrelated companies include the
retail seller you bought from.
**Vermont, California and Nevada** residents have additional protections, and we do not sell your
information. The full notice is in our
[Privacy Policy](https://universalaccountservicing.com/privacy).
**Your lender has its own privacy notice, and it may differ from ours.** The privacy page carries
several — UAS first, then the bank or credit union that funded your loan. Read the one that names
your lender as well as ours; they do not say the same things about sharing.
## How we secure our systems
We use security measures that comply with federal law, including computer safeguards, secured files
and secured buildings, and we maintain PCI DSS compliance for card data.
Card and bank account data is **encrypted both in transit and at rest**. Your security code is
never retained once the authorization it was used for has expired. Access to payment data is limited to
staff with a documented reason to have it.
Our security is tested rather than asserted: a PCI DSS assessment every year, carried out at the
level that applies to us by a qualified assessor, and external vulnerability scans every quarter by
an approved scanning vendor. Companies that handle card or bank data on our behalf have to meet the
PCI standard that applies to them, and prove it to us annually.
Our information security program is also examined independently. We hold SOC 1 Type 2 and SOC 2
Type 2 reports covering security, availability and confidentiality, and our program has been
reviewed against ISO/IEC 27001.
Those reports are prepared for institutional partners and auditors and are not distributed to the
public. If you are evaluating UAS on behalf of a lender or school, request the vendor-management
package through your UAS contact.
## How we contact you, and how we don't
We may call, text, email or write to you about your account, including using automated dialing and
prerecorded messages — but **not to market to you**. Calls may be monitored or recorded.
We will never ask you for your full card number or your security code by email or text. If you
receive a message that does, do not reply to it — see
[How and when we contact you](/trust-and-compliance/how-we-contact-you).
## If you think something is wrong
Call us. If you believe someone has used your account, or that the account is not yours at all, say
so when you call — that is handled differently from a routine question, and there is a separate
identity-theft route in [Opening a support request](/getting-help/opening-a-support-request).
Have your Account Number to hand if you have it.