You should really get an SSL Cert if you asking people to upload such sensitive information as their credit report.

Just my 2 cents...