Domain Atlas / Housing & homelessness services
CrimSAFE criminal-record tenant screening
CrimSAFE, a criminal-record tenant-screening product sold by CoreLogic Rental Property Solutions, computes no risk score: it is a deterministic record-matching and filtering engine that matches applicant identity data against a database of court and arrest records aggregated from more than 800 US jurisdictions, classified into three primary categories (Crimes Against Property, Crimes Against Persons, Crimes Against Society) with sub-classifications, and applies filter criteria the HOUSING PROVIDER configures: offense type, disposition and severity across felony and non-felony convictions and charges, and a lookback period configurable from 0 to 99 years for convictions and 0 to 7 years for charges (federal consumer-reporting law permits reporting non-conviction records for seven years). The output is a report carrying a lease decision driven by the provider's criteria plus a credit score, a Record(s) Found flag, message text the provider authors, full record detail for the users the provider authorizes, and an optional provider-customizable adverse-action letter template. Every new CrimSAFE user is by default authorized to receive full record data, with no cap on how many users get full access; a provider must affirmatively change configuration settings to restrict full reports to senior managers. In April 2016 Carmen Arroyo's application to move within ArtSpace in Windham, Connecticut, so her son Mikhail could live with her after a 2015 injury, was denied on 26 April 2016 after the screen returned Record(s) Found; the only matched record was a pending Pennsylvania shoplifting charge, later withdrawn in April 2017. Mikhail's report carried the vendor's default message: 'Please verify the applicability of these records to your applicant and proceed with your community's screening policies.'[3]
What happened
In April 2016 Carmen Arroyo applied to move within ArtSpace in Windham, Connecticut, so that her son Mikhail — left unable to speak, walk or care for himself by a 2015 accident — could live with her. The property manager, WinnResidential, ran the application through CrimSAFE, a criminal-record screening product sold by CoreLogic Rental Property Solutions. The screen returned "Record(s) Found" and the application was denied on 26 April 2016. The only matched record was a pending Pennsylvania shoplifting charge, which was withdrawn in April 2017.
CrimSAFE does not score applicants. It is a record-matching and filtering engine: it matches applicant identity data against CoreLogic's database of court and arrest records aggregated from more than 800 US jurisdictions, sorted into three primary categories — Crimes Against Property, Crimes Against Persons, Crimes Against Society — with sub-classifications, and it applies filter criteria the housing provider configures. Those criteria are offense type, disposition and severity across felony and non-felony convictions and charges, and a lookback window the provider sets between 0 and 99 years for convictions and 0 and 7 years for charges. Federal consumer-reporting law permits non-conviction records to be reported for seven years. The output is a tenant-screening report carrying a lease decision driven by the provider's criteria together with a credit score, a Record(s) Found flag, message text the provider authors, full record detail for the users the provider authorizes, and an optional adverse-action letter template the provider can customize. Mikhail's report carried the vendor's default message: "Please verify the applicability of these records to your applicant and proceed with your community's screening policies."
Two configuration facts shaped what happened next. CoreLogic's default authorizes every new CrimSAFE user to receive full record data, with no cap on how many users hold that access; a housing provider must affirmatively change the settings to restrict full reports to senior managers. WinnResidential did exactly that, suppressing full reports from on-site staff so that leasing decisions involving criminal records would be made "by someone in a more elevated position," out of a concern that leasing agents' commission incentives should not drive record-based decisions. The result was that the on-site leasing agent saw only that a disqualifying flag existed, and told Arroyo the application was denied without individualized review. Answering Arroyo's later complaint to the Connecticut Commission on Human Rights and Opportunities, WinnResidential said it did not know "the facts behind the criminal background findings" because it had "trust" in CoreLogic's reports.
The route by which a person can see and correct their own file ran into a wall. Arroyo, Mikhail's conservator, first requested the file on 24 June 2016 with a conservatorship certificate. CoreLogic's Authentication Procedure Guide listed only a notarized power of attorney as third-party authorization, and directed "any scenarios not covered" to a supervisor; staff demanded a power of attorney that Mikhail, as a conservatee, was legally incapable of executing — a demand the trial court called an "impossible condition." Only after a 1 November 2016 call escalated to CoreLogic's legal department did the company agree, about two weeks later, that a conservatorship certificate with a visible probate seal would suffice; the copy Arroyo resubmitted again lacked a visible seal and the disclosure was never completed. The family learned which record had caused the denial in December 2016, roughly eight months after it, and learned it from the housing provider rather than from CoreLogic. The adverse-action letter that should have opened the correction path was sent and never received. Correction ultimately happened at the source: Arroyo petitioned the Pennsylvania court and the charge was withdrawn in April 2017. Hers was the first and only conservator file-disclosure request CoreLogic had ever received.
The Commission held an evidentiary hearing on 13 June 2017 and WinnResidential approved the move-in ten days later — about fourteen months after the denial, and the only oversight action in this record documented to have changed an outcome. The Connecticut Fair Housing Center and the Arroyos sued CoreLogic on 24 April 2018. On 25 March 2019 the court denied CoreLogic's motion to dismiss in one of the first federal decisions holding that tenant-screening companies must comply with the Fair Housing Act, a ruling fair-housing advocates treated as a landmark. At summary judgment in August 2020 Judge Vanessa L. Bryant used the language later quoted everywhere — that the companies "acted hand-in-glove" and that CoreLogic "was an integral participant" — but that was the summary-judgment posture, where allegations are construed for the party opposing the motion, and it is not what survived. After a ten-day bench trial spread across 2022, the same judge ruled on 20 July 2023 that CrimSAFE does not disqualify applicants: the housing provider decides what records matter and whether to deny. She found only a willful violation of the consumer-reporting statute for the impossible-condition disclosure policy, awarding $1,000 statutory and $3,000 punitive damages plus fees.
The United States, through the Justice Department's Civil Rights Division with HUD, filed an amicus brief on 24 November 2023 arguing that tenant-screening companies are not categorically outside the Fair Housing Act. The Second Circuit (Cabranes, Wesley and Menashi, opinion by Judge Menashi) decided the appeal on 20 February 2026. It agreed with the federal government's doctrinal point — the Act excludes no class of defendants and a non-landlord can be liable — and still affirmed, on proximate cause: the denial of housing came not at the first step after CoreLogic's conduct but after a chain of the provider's discretionary decisions, which the panel enumerated as configuration, record relevance, staff access, adverse-action letters, and final approval. The panel quoted the district court's own sentence with approval: "No housing provider who uses CrimSAFE could reasonably believe that CoreLogic makes housing decisions for them." It rejected the argument that WinnResidential was a mere conduit for CoreLogic's policies, because the screening policies applied were the provider's own, and it rejected the argument that CoreLogic should be liable for declining to restrict records the law permits it to report, holding that would extend liability beyond the first step. It dismissed the Connecticut Fair Housing Center's own claim for lack of constitutional standing, applying a 2024 Supreme Court decision about organizational injury that has nothing to do with tenant screening, and it denied the Center's post-argument motion to dismiss its own appeal voluntarily, citing concern about strategic manipulation of precedent. Finally it reversed the sole liability finding: because Arroyo never furnished a copy showing the seal after being clearly told one would work, the consumer-reporting claim failed. The $4,000 award was erased. CoreLogic exited nearly eight years of litigation owing nothing, and no injunction, consent decree or ordered policy change appears anywhere in the record.
The sociotechnical reading
What makes this deployment worth studying is that the location of decision authority was itself the contested question, and an appellate court answered it component by component. The vendor supplies the store, the classification scheme and the matching mechanism. The provider owns configuration, record relevance, staff access, the letter, and the final call. On that map the harm to the applicant sits beyond the first step from the vendor, which is why nearly eight years of litigation produced an authoritative account of the system and no liability for the company at its center.
Two structural features do the work. The first is configurable opacity. The vendor's product ships with a permissive default — every new user receives full record data, with no cap on how many — and gives the buyer a setting to restrict it. This buyer used that setting for a defensible reason: it did not want leasing commissions driving record-based decisions, so it routed full reports to a more elevated position. The effect at the point of contact was that the person facing the applicant held a flag and no record, could not conduct an individualized review, and announced the denial. Meanwhile the elevated tier that did receive the full report told a state commission it did not know the facts behind the findings because it trusted the vendor's reports. Formal discretion stayed maximal and practical discretion emptied out, and the courts certified the formal map over the practical one. The case is evidence of that gap, not evidence that the gap does not exist; a reader who takes only the certified layer will misread what happened at the desk.
The second is that the feedback pathology here has nothing to do with learning. There is no retraining loop and no score to update. What failed was record visibility and record provenance: a pending charge propagated from a court record into a proprietary store into a disqualifying flag; the statutory channel for seeing and correcting one's own file was blocked for months by a documentation demand aimed at a person legally incapable of meeting it; and the correction that eventually worked happened at the originating court, by petition, and never reached the store. That is memory-store contamination with the audit edge open at both ends. It is also, in this record, a first-of-its-kind request — nobody had built a procedure for a conservator, and that rarity was used by both courts to defeat the disability claim, which is a lesson about how edge cases are governed as much as about this one.
Two boundaries belong on this reading. Disparate impact was never proven: the race and national-origin claim failed at the prima facie causation step, so the underlying statistics were never adjudicated, and the general premise that criminal-record screening burdens some applicants more than others lives in party briefs, a federal amicus filing and journalism rather than in findings from this case. And the fair-housing organization that had monitored this practice was removed from the litigation by a standing doctrine decided in an unrelated case, which vacated rather than decided the merits of its claim — an oversight relationship whose existence turned on a parameter nobody in this deployment controlled. The people the outcome landed on are outside every model here: fourteen months of denied housing for a family trying to bring home a son who could not speak, walk or care for himself, and eight months before they could even learn which record had done it.
The concepts used in this reading are defined in the Field Guide; the governance responses live in the Practice Library.