Credit Analysis with SCR

We will explain below the SCR collection flow using external authorization, obtained through your own journey.

Due to Brazilian banking secrecy laws, it is mandatory to obtain the client’s explicit consent in order to access their information in the SCR (Credit Information System). For this reason, in our SCR query flow, authorization is a required step. This authorization can either be captured by us, QI Tech, or collected and sent by you, our partners.

When consent capture is performed by QI Tech (Natural Person):

In the case of a natural person, for QI Tech to send the consent request, it is sufficient to fill in the personal data of the individual in the CreditProposal object. QI Tech will then send the consent request to the individual via email and, once authorized, will automatically perform the consultation and make the results available for credit analysis.

It is mandatory to include the fields document_number, name, and email — if the request is sent via email — and the phone object — if the request is sent via WhatsApp or SMS — in order to collect consent from a natural person through QI Tech.

When consent is captured by QI Tech (Legal Person):

If the consent is captured by our team, the integration process is straightforward and does not require major adjustments. After the request is sent—either manually or via API—, we automatically trigger the consent process, which is signed through QI Sign, our electronic signature platform. The signing link can be sent via SMS or email. Once the document is signed, the flow proceeds as normal.
For API integration, no additional information is needed for individuals. However, for legal entities, the following field must be included:

The "signers" object must contain the information of the individuals who will sign the document. The signer must be a legal representative of the company.

When consent is captured by the partner (Legal Person):

If the partner collects the consent, the flow must be carried out via API, and the authorization information must be included in the request payload. In general, the additional fields are similar for individuals and legal entities, with the difference that the "signers" object is only required for legal entities. Below is an example of the payload format and a description of its components:

• The "signers" field must include information about the signatory representing the legal entity. This person must be a legal representative of the company. The "signature_evidence" object holds data regarding the collection and storage of the consent. If auditing of the signed terms is needed, the fields "session_id" and "additional_data" should contain information to locate the consent. We recommend that "session_id" contains a unique identifier for the consent and that "additional_data" includes a link to access the consent (e.g., in a bucket or drive).
• The "ip_address" field must contain the IP address of the machine where the signature was performed.
• The "access_token" field should provide the token used to sign the document.
• The "signed_term" must contain the full text of the collected consent.

After the request with consent information is submitted, the process will start and the SCR data will be displayed in the Credit Analysis.

When consent capture is performed by the partner (Natural Person):

The payload follows the same structure as the one used for legal entities, but without the signers object.