Searching is performed on the individual's United States Social Security Number (USSSN) or Date of Birth (DOB) and last name. A search can also be invoked without providing a USSSN. If a USSSN cannot be provided, each search record must contain:

• First Name
• Last Name
• Street Address
• City
• State
• Postal Code

Some clients request a "screen shot" of the data being submitted to the SCRA website as "proof of submission". There are two problems with this request:

1. Such a screen shot does not constitute proof (i.e. it can be easily fabricated)
2. The "screen shot" is required for human users, but is never actually used by automation

Why a screen shot does not constitute proof

One can easily bring up the DoD website, key in data, and print the page. This does not mean that the user actually clicks on the "Lookup" button. As a result, this "proof" can be easily fabricated.

Why the screen shot is never actually used by automation

"Web pages" are HTML rendered by a browser generally geared for human eyes. It does nice things like prompt people to enter the correct data fields, and provide a Lookup button to tell the browser to transmit data back to the SCRA servers. When a user clicks on the "Lookup" button, the user's browser just transmits the data fields to the SCRA servers.

Quandis' technology just transmits the data fields to the SCRA servers, without ever requesting the HTML page that prompts users to enter data fields. Not only is such a page useless to the automation software, requesting the HTML from the SCRA website with every search would actually slow the search down.

Solution

Proof of submission means proof that the SCRA website actually received the data Quandis claims to have submitted. The DoD recognizes the need to provide an audit trail in case questions arise about the validity of data in the future. To solve this, DoD provides a ReportID, which is a unique identifier that can be used to reconcile with the DoD at a future date. The ReportID cannot be faked, and is proof both that Quandis submitted the data, and that the SCRA website received the data.

Should a court require that a bank "prove" the DoD listed a service member as active (or not), one must simply contact the DoD with the ReportID, and the DoD can provide the data that was submitted. This is the only fool-proof audit trail.

Yes. QMS can transform our native QBO formatted data into your organization's format. This is extra effort and will impact the implementation timeline.

Yes! We support OpenAPI and SOAP. Orders can be submitted and product data can be accessed through these channels.

Yes. However there are two considerations:

1. if the current endpoint is not supported by QMS standard protocols then a custom component will need to be built.
2. Your current endpoint may require a certain XML format to correctly function. When QMS connects to a custom endpoint, we generally transform the data from our standard format to the required endpoint format.

This is extra effort and will impact the implementation timeline.

Yes. Our web based API utilizes HTTPS.  Clients can also transmit batch orders as Excel files with PKI and/or transmitted securely via sFTP. Once on the Quandis network, the request files are processed and individual borrower names and SSNs are stored in a secure SQL Server (with NPI being symmetrically encrypted at rest). Data is transmitted between QMS and the SCRA website over HTTPS.

Yes, result files are built on the QMS platform, and may be encrypted with PKI and/or transmitted securely via sFTP, FTPS or HTTPS to the client. We can email clients with a secure hyperlink to download the result file. Each search includes a PDF document containing the image of the SCRA website results. Neither this image nor the aggregate results file contain SSNs, though they usually contain borrower information and loan numbers, so continue to be treated securely.

QMS is a completely automated platform; Quandis employees are not involved with the mechanics of a military search. Quandis system administrators have access to the servers on which the data is processed, and are governed by our Security Policy and Procedures document.

The request and result files are encrypted and/or transmitted via secure channels (sFTP, FTPS, or HTTPS). All data within QMS is stored in a secure SQL Server database, with SSNs being encrypted at rest. SQL backups are encrypted, and stored on RAID media in our alternate production data center. RAID media is physically destroyed upon disposal. We do not use tape backups or off-site storage of our backups. All access to RAID media is tightly controlled with a minimum of two-factor authentication, and employees with access are trained in accordance with our Security Policy and Procedures document.

We retain all data for 90 days by default. However, we can configure on a client-by-client basis different retention periods to comply with client retention policies. We recommend 90 days ensuring we can answer any questions that may arise concerning your data. The monitoring product requires that we retain the data for at least the duration of monitoring.

QMS is cloud hosted and load balanced web and application servers integrate with SQL Server for back end data storage. The limiting factor in volume is the DoD's SCRA website. Our APIs support configurable rate limits and our batch and monitoring products layer on top of DMDC Multiple records submission.

There are 5 possible statues: Active Duty, Discharged, Not Found, Unable To Process and Undetermined.

• Active Duty - Indicates Active Duty information was located based on SSN or birth date and last name. This is considered a match.
• Discharged - Indicates Active Duty information was located based on SSN or birth date and last name. The contact shows a discharge date.
• Not Found - Indicates SCRA has no information based on SSN or birth date and last name. This is considered a no hit.
• Unable To Process - Indicates an error was encountered when searching SSN or birth date and last name. SCRA generally returns this error when the SSN appears to be in a fictitious pattern such as 999999999 or 111111111. In a very small percentage of cases the SCRA will return this status with what appears to be a valid SSN and last name.
• Undetermined - Multiple individuals located with the same last name which share the same birth date. Generally speaking, this type of match requires further investigation.

The DoD system will return one of the following:

• Army National Guard
• Army Active Duty
• Army Temporary
• Army Reserve
• Army Unknown
• Coast Guard Active Duty
• Coast Guard Reserve
• Air National Guard
• Air Force Active Duty
• Air Force Temporary
• Air Force Reserve
• Public Health Services
• Marine Corps Active Duty
• Marine Corps Temporary
• Marine Corps Reserve
• Marine Corps Unknown
• Navy Active Duty
• Navy Temporary
• Navy Reserve
• Navy Unknown
• Nat'l Oceanic & Atmospheric Administration

The branches can optionally be condensed to Air Force, Army, Coast Guard, Marine Corps, Navy, NOAA, Public Health Service for simplicity.

Safe harbor, as referenced in the MLA, identifies the sources of data which constitute a legally valid check of covered borrower status. Creditors will have a "safe harbor" if they use one of two methods:

• Using DoD's (DMDC) Database
• Using a credit report provided by a national consumer reporting agency

Quandis' MLA Search results come directly from the DMDC database, just like the credit reporting agencies results do.

If you use a source of data other than the ones listed above, you will be legally liable for any discrepancies between your results and the DoD's data.

Yes. Quandis MLA Search performs a real-time search against the DMDC website, which is the "source of truth" for safe harbor results. The key difference between Quandis MLA and a manual search of the DMDC website is Quandis MLA Search results are returned in XML or JSON format, instead of PDF.  We simply parse the PDF returned by DMDC, translating the results into XML or JSON.

DMDC provides a "certificate number" that is unique to each search, and can be used to audit the results. Quandis MLA Search extracts this certificate number from the PDF, and includes it in the XML or JSON results. This certificate number provides proof that the search was done against a "safe harbor" data source.

The DMDC database contains military service members, as well as their dependents -- in short, all covered borrowers. If your applicant is named John Doe, and is married to (or otherwise a dependent of) Jane Doe (an active duty service member), you don't need to search for Jane. If he's covered by the MLA, John Doe will be listed in the DMDC database.

With that said, make sure your names match! John Smith Doe is not the same as John Doe. Quandis' name permutation logic will automate such checks for you.

The source of data for both Quandis MLA Search and the credit bureaus is the same - the DMDC database. Note that the credit bureaus do not have a copy of the DMDC database; they use the DMDC API via the DMDC website to retrieve the information. In short, the credit bureaus get their MLA results from the same website Quandis does.

The Quandis MLA Search results are always performed in real time. When you get credit bureau results, the MLA results may be up to 30 days old.

A Dependent is defined as follows:

1. A spouse;
2. A child who:
   • Is under age 21;
   • Is under age 23 and is a full-time student and is (or was at the time of the service member’s death) dependent on the member for over one-half of the child’s support; or
   • An unmarried person who:
     • Is placed in the legal custody of the service member by court order for at least 12 consecutive months; or
     • Has either (i) not reached age 21 or (ii) has not reached age 23 and is a full-time student; or (iii) is incapable of self-support because of mental or physical incapacity that occurred while the person was considered a dependent of the service member; and
     • Is dependent on the service member for over one-half of the person’s support; and
     • Resides with the service member unless separated by the necessity of military service or to receive institutional care as a result of disability or incapacity; and
     • Is not otherwise a dependent under any of the other statutory definitions.

• Unsecured consumer lines of credit
• Credit cards
• Unsecured closed-end loans
• Non-purchase-money secured closed-end loans

• Annual Percentage Rate: 36% Limitation
• Removal of Mandatory Arbitration Clause
• Removal of Borrowers Waiver of the Right to Legal Recourse
• Creditors are Prohibited from using the Title of a Vehicle as Security for the Obligation
• Creditors must allow the borrower to prepay the loan and can't charge a penalty or fee for prepaying all or part of the loan.

When you pass Quandis your borrower name and SSN, we will perform a real time search against the DMDC website, returning XML or JSON indicating whether the borrower is a covered borrower.

Other safe harbor options include:

1. Using the DoD’s Defense Manpower Data Center (DMDC) Database.
2. Using a credit report provided by a national consumer reporting agency, or a reseller of that credit report, that complies with the Fair Credit Reporting Act (FRCA). Use of alternative or regional credit reporting agencies would not provide a safe harbor.

Consumers may sue creditors for violations of the new rule, and regulators can also enforce certain penalties if the rules are violated. If a creditor is found to have violated the new rules, the following applies:

• The loan is void from the inception of the contract
• If an arbitration agreement was required, it is unenforceable
• Consumers may recover actual damages of at least $500 for each violation, as well as punitive damages, equitable or declaratory relief, and any other relief provided by law
• Consumers may recover the costs of the action and their reasonable attorney’s fees
• Consumers may pursue any other rights or remedies under any other applicable law may be used, including consequential or punitive damages
• If the creditor knowingly violates the rules, it is a misdemeanor.

The creditor may rely on the information obtained from either method if the creditor obtains it within 30 days prior to the time the consumer initiates the transaction or applies for credit. Quandis' MLA Search results are performed in real time against the DMDC database, so they're always fresh - never stale. Thus, the 30 day 'clock' starts upon receipt of the results from Quandis.