So you're going to whitelist every mortgage broker, car dealer, apartment manager, etc who might need to pull a credit report? Doesn't sound practical.
Won't be perfectly secure, but it diminishes a major area of risk.
(There are other architectures that will accomplish the same thing, the key is that if a machine can access the user databases, you should be drastically limiting what kind of outgoing connections it can make.)