Answers for engineering, security, and compliance

A platform to encrypt, tokenize, control access to, and audit sensitive data (PII, PHI, PCI, and credentials) through one API instead of building an internal vault team.

Teams that handle regulated customer data: fintech, healthtech, HR platforms, and any product storing SSNs, health records, or payment details.

Homegrown vaults often start as column encryption and grow into a platform team owning rotation, tenant isolation, audit integrity, and DSAR workflows. PIIsafe ships that as a product.

All three: multi-tenant SaaS, dedicated single-tenant SaaS, and self-hosted for regulated workloads. BYOK and HYOK supported in each.

100 protected records, customer-managed keys, audit log streaming, region pinning, and multi-sig for sensitive operations. No credit card required to start. There are no per-seat charges.

Encryption transforms data so only someone with the key can read it. Tokenization replaces sensitive values with a reference token your app stores instead. PIIsafe stores the encrypted value in a vault; your database keeps the token. You detokenize only when policy allows.

TLS 1.3 in transit. AES-256-GCM at rest with envelope encryption: unique data key per record, wrapped by your master key.

You choose: platform-managed, customer-managed (BYOK from AWS/GCP/Azure/HashiCorp), or hold-your-own-key in your HSM.

In tokenization flows, sensitive fields are encrypted at the edge and only tokens are stored. In some storage flows, plaintext exists briefly in encrypted memory during processing, never written to disk or logs.

Backups contain ciphertext and wrapped keys. Without your master key, data cannot be decrypted. Per-record keys limit blast radius.

Yes. Email security@piisafe.io for the latest summary under NDA. SOC 2 Type II audit is underway.

BYOK (bring your own key) means your master encryption key lives in your cloud KMS (AWS, GCP, Azure, or HashiCorp Vault). HYOK (hold your own key) means the master key stays in your HSM and PIIsafe cannot decrypt without your authorization.

No. Customer data is never sold, shared with ad networks, or used to train AI models. This is written into the DPA. PIIsafe does not contact your customers unless you configure it to.

No. Both audits are underway and neither certification has been issued yet. Architecture documentation, pen-test summaries, and pre-filled vendor questionnaires are available under NDA while the audits complete. See our compliance roadmap for current status.

GDPR DPA is available on supported plans. HIPAA BAA is in progress. SOC 2 Type II and ISO 27001 audits are underway; neither certification has been issued yet. Pen-test summaries, architecture docs, and pre-filled SIG and CAIQ questionnaires are available under NDA.

Controls aligned with SOC 2 Type II, HIPAA, ISO 27001, GDPR, CCPA, DPDP, and PIPL. Audit exports you can attach to reviews are available today.

Email security@piisafe.io. We typically deliver the security pack the same day under NDA. It includes the architecture overview, pen-test summary, cryptography design, sub-processor list, data-flow diagrams, and pre-filled SIG and CAIQ questionnaires.

Yes. A GDPR-aligned DPA is available on supported plans, alongside region pinning and DSAR tooling.

HIPAA-aligned configuration and BAA support are in progress.

Yes. Vaults pinned to US, EU, UK, Canada, or APAC. Data, replicas, and backups stay in-region unless you explicitly move them.

Search by subject across vaults, export in structured format, redact, or erase. Erasure uses cryptographic shredding with a signed report.

First encrypted record within an hour for most teams. Production rollouts with policy and IdP wiring: one to four weeks.

No. The drop-in proxy tokenizes inbound requests and detokenizes outbound responses with no code changes. Use the SDKs when you want direct API integration.

Typed SDKs for TypeScript/Node and Python, plus a command-line tool, are available today; a Go SDK is next. REST and gRPC cover everything else.

A network proxy that sits in front of your existing services. It tokenizes sensitive fields on inbound requests and detokenizes on outbound responses, so you do not have to rewrite application code to get started.

Yes. Prompt-time SDK scrubs PII before third-party models and reinserts values in responses.

No. Not for our models or third parties. Written into the DPA.

99.99% target for hosted product. Multi-AZ active-active for crypto operations. Status page published.

Email security@piisafe.io. Acknowledgment within one business day, triage within three.

If unauthorized vault access is detected, you hear from an engineer within 24 hours of detection with what we know and next steps.

Yes. Export tokens, ciphertext, and audit logs in migration-friendly formats. You can leave at any time without a lock-in period.

We publish the sub-processor list in the security pack. Material changes are announced at least 30 days before they take effect.