Searching is performed on the individual’s United States Social Security Number (USSSN) or Date of Birth (DOB) and last name. A search can also be invoked without providing a USSSN. If a USSSN cannot be provided, each search record must contain:

• First Name
• Last Name
• Street Address
• City
• State
• Postal Code

There are 5 possible statues: Active Duty, Discharged, Not Found, Unable To Process and Undetermined.

• Active Duty – Indicates Active Duty information was located based on SSN or birth date and last name. This is considered a match.
• Discharged – Indicates Active Duty information was located based on SSN or birth date and last name. The contact shows a discharge date.
• Not Found – Indicates SCRA has no information based on SSN or birth date and last name. This is considered a no hit.
• Unable To Process – Indicates an error was encountered when searching SSN or birth date and last name. SCRA generally returns this error when the SSN appears to be in a fictitious pattern such as 999999999 or 111111111. In a very small percentage of cases the SCRA will return this status with what appears to be a valid SSN and last name.
• Undetermined – Multiple individuals located with the same last name which share the same birth date. Generally speaking, this type of match requires further investigation.

The DoD system will return one of the following:

• Army National Guard
• Army Active Duty
• Army Temporary
• Army Reserve
• Army Unknown
• Coast Guard Active Duty
• Coast Guard Reserve
• Air National Guard
• Air Force Active Duty
• Air Force Temporary
• Air Force Reserve
• Public Health Services
• Marine Corps Active Duty
• Marine Corps Temporary
• Marine Corps Reserve
• Marine Corps Unknown
• Navy Active Duty
• Navy Temporary
• Navy Reserve
• Navy Unknown
• Nat’l Oceanic & Atmospheric Administration

The branches can optionally be condensed to Air Force, Army, Coast Guard, Marine Corps, Navy, NOAA, Public Health Service for simplicity.

Some clients request a “screen shot” of the data being submitted to the SCRA website as “proof of submission”. There are two problems with this request:

1. Such a screen shot does not constitute proof (i.e. it can be easily fabricated)
2. The “screen shot” is required for human users, but is never actually used by automation

Why a screen shot does not constitute proof

One can easily bring up the DoD website, key in data, and print the page. This does not mean that the user actually clicks on the “Lookup” button. As a result, this “proof” can be easily fabricated.

Why the screen shot is never actually used by automation

“Web pages” are HTML rendered by a browser generally geared for human eyes. It does nice things like prompt people to enter the correct data fields, and provide a Lookup button to tell the browser to transmit data back to the SCRA servers. When a user clicks on the “Lookup” button, the user’s browser just transmits the data fields to the SCRA servers.

Quandis’ technology just transmits the data fields to the SCRA servers, without ever requesting the HTML page that prompts users to enter data fields. Not only is such a page useless to the automation software, requesting the HTML from the SCRA website with every search would actually slow the search down.

Solution

Proof of submission means proof that the SCRA website actually received the data Quandis claims to have submitted. The DoD recognizes the need to provide an audit trail in case questions arise about the validity of data in the future. To solve this, DoD provides a ReportID, which is a unique identifier that can be used to reconcile with the DoD at a future date. The ReportID cannot be faked, and is proof both that Quandis submitted the data, and that the SCRA website received the data.

Should a court require that a bank “prove” the DoD listed a service member as active (or not), one must simply contact the DoD with the ReportID, and the DoD can provide the data that was submitted. This is the only fool-proof audit trail.

Yes. QMS can transform our native QBO formatted data into your organization’s format. This is extra effort and will impact the implementation timeline.

Yes! Our web based API supports REST and SOAP. Orders can be submitted and product data can be accessed through these channels.

Yes. However there are two considerations:

1. if the current endpoint is not supported by QMS standard protocols then a custom component will need to be built.
2. Your current endpoint may require a certain XML format to correctly function. When QMS connects to a custom endpoint, we generally transform the data from our standard format to the required endpoint format.

This is extra effort and will impact the implementation timeline.

Yes. Our web based API utilizes HTTPS.  Clients can also transmit batch orders as Excel files with PKI and/or transmitted securely via sFTP or FTPS. Once on the Quandis network, the request files are processed and individual borrower names and SSNs are stored in a secure SQL Server (with SSNs being symmetrically encrypted at rest). Data is transmitted between QMS and the SCRA website over HTTPS.

Yes, result files are built on the QMS platform, and may be encrypted with PKI and/or transmitted securely via sFTP, FTPS or HTTPS to the client. We can email clients with a secure hyperlink to download the result file. Each search includes a PDF document containing the image of the SCRA website results. Neither this image nor the aggregate results file contain SSNs, though they usually contain borrower information and loan numbers, so continue to be treated securely.

QMS is a completely automated platform; Quandis employees are not involved with the mechanics of a military search. Quandis system administrators have access to the servers on which the data is processed, and are governed by our Security Policy and Procedures document.

The request and result files are encrypted and/or transmitted via secure channels (sFTP, FTPS, or HTTPS). All data within QMS is stored in a secure SQL Server database, with SSNs being encrypted at rest. SQL backups are encrypted, and stored on RAID media in our alternate production data center. RAID media is physically destroyed upon disposal. We do not use tape backups or off-site storage of our backups. All access to RAID media is tightly controlled with a minimum of two-factor authentication, and employees with access are trained in accordance with our Security Policy and Procedures document.

We retain all data for 1 year by default. However, we can configure on a client-by-client basis different retention periods to comply with client retention policies. We recommend 1 year ensuring we can answer any questions that may arise concerning your data. The monitoring product requires that we retain the data for at least the duration of monitoring.

Quandis maintains multiple SOC-2 certified data centers. Our Military Search primary hosting location in our CA data center, with nightly backups transmitted to an alternate data center. Load balanced web and application servers integrate with SQL Server 2008 for back end data storage. The limiting factor in volume is the DoD’s SCRA website. We typically process 10K orders per hour in our near real-time channel and support DoD batch volume.