Upload only requested reports, ID and proof of current address. Provide SSN verification only if specifically required. Never upload passwords.