Real questions,answered in detail.

PIIsafe is a privacy infrastructure platform. It gives engineering, security, and compliance teams a single place to encrypt, tokenize, govern, and audit sensitive data — PII, PHI, PCI, and credentials — without ever holding plaintext in their own application servers. PIIsafe sits between your applications and your databases, so the boundary where sensitive data is handled becomes a small, well-tested system instead of every service in your stack.

PIIsafe is built for any organization that handles regulated or sensitive customer data and treats privacy as a product requirement rather than a paperwork exercise. Common deployments include fintech and payments, digital health, HR and people-data, government and education, AI/ML platforms that fine-tune on sensitive corpora, and SaaS companies that need to satisfy enterprise security reviews without building a vault from scratch.

A homegrown vault is achievable, but it usually starts as a column-level encryption library and ends as a small platform team owning key rotation, tenant isolation, audit log integrity, DSAR workflows, and compliance evidence. PIIsafe ships those concerns as a product. You keep ownership of your keys and policies; we own the boring, dangerous parts: cryptographic correctness, tamper-evident logs, and the edges where data leaks happen.

PIIsafe spans tokenization, vaulting, key management, access policy, and audit in a single product, instead of stitching them together. The platform was designed around a few specific assumptions: customer-held keys are the default not the upsell, every feature ships on every plan, and the audit log is exported to your SIEM by default. The shape of those decisions tends to make the difference for teams whose security review fails on "show me the evidence" rather than "show me the architecture diagram."

PIIsafe is offered as multi-tenant SaaS, dedicated single-tenant SaaS, and a self-hosted deployment for regulated workloads. Customer-managed and hold-your-own-key configurations are supported in all three modes — your master key never has to leave your control, regardless of the deployment shape.

Data in transit uses TLS 1.3 with modern cipher suites and certificate pinning where supported. Data at rest uses AES-256-GCM with envelope encryption: every record is encrypted with a unique data key, which is then wrapped by a master key under your control. There are no plaintext fallbacks, no homegrown ciphers, and no "we hash it" shortcuts.

You decide. PIIsafe supports platform-managed keys (we hold and rotate them on your behalf), customer-managed keys (you bring a key from AWS KMS, Google Cloud KMS, Azure Key Vault, or HashiCorp Vault), and hold-your-own-key (the master lives in your HSM and signs every wrap/unwrap operation). In CMK and HYOK modes, revoking access in your KMS makes the data unreadable — even to PIIsafe.

In tokenization flows, no — sensitive fields are encrypted at the edge, only the token is stored, and detokenization happens against your access policies. In storage flows, plaintext exists only briefly inside an encrypted memory boundary while it is being encrypted with your data key, and is never written to disk or logs. In HYOK mode, even that boundary is sealed by your HSM.

A leaked backup contains only ciphertext and wrapped data keys. Without your master key, the data cannot be decrypted. Because each record uses a unique data key, even cryptographic compromise of one record does not cascade to the rest of the dataset. This is the same property that makes envelope encryption a control auditors actually credit.

PIIsafe enforces least-privilege at the policy layer. Engineers do not have standing access to customer data; sensitive operations require just-in-time approval, MFA, and (for high-risk operations) multi-signature approval. Every read is logged in a tamper-evident audit log that customers replicate to their own SIEM in real time.

Yes — both internal red-team exercises and external assessments. The latest pen-test summary is shared under NDA from the customer trust portal, along with our cryptography review. Formal SOC 2 Type II and ISO 27001 audits are in flight; until they complete, we list those frameworks as "Coming soon" rather than claim them.

PIIsafe is engineered against SOC 2 Type II, HIPAA, ISO 27001, GDPR, CCPA, DPDP, and PIPL. Formal certifications are in progress; even before they complete, we provide compliance evidence packs assembled from real platform activity that fit directly into your own audit binder. Customers in regulated industries (health, fintech, government) are typically using PIIsafe under their own compliance umbrella well before our certificates are framed.

Yes. PIIsafe offers a HIPAA-aligned configuration and signs a BAA with covered entities and business associates on supported plans.

Yes. Vaults are pinned to a region — US, EU, UK, Canada, or APAC — and data, including replicas and backups, never leaves that region without an explicit, logged action. This satisfies GDPR, DPDP, and PIPL data-residency requirements, as well as enterprise contracts that prohibit cross-border processing.

PIIsafe ships data subject request automation: search by subject across vaults, export their data in a structured format, redact selectively, or erase entirely. Erasure is implemented as cryptographic shredding of the data key, which preserves accounting integrity (totals and counts survive) while making the underlying data mathematically unrecoverable. Every request produces a signed report that can be handed to a regulator or to a customer.

Every infrastructure or analytics sub-processor is published on the trust page. Material changes — adding a sub-processor, changing a region — are announced 30 days in advance, so your security review is never surprised.

Most teams have their first encrypted record within an hour of signup using the SDKs. Production rollouts — including policy design, IdP wiring, and migration of existing data — typically take one to four weeks depending on the surface area you are protecting. Migration support is included on every paid plan, with a named engineer assigned on enterprise.

No. The PIIsafe drop-in proxy lets you route an existing service through PIIsafe with no code changes — sensitive fields are tokenized inbound and detokenized outbound according to policy. SDKs are available when you want fine-grained control inside an application, but they are an upgrade, not a prerequisite.

First-class SDKs for Node, Python, Go, Java, Ruby, and .NET. Runtime adapters for Next.js, NestJS, FastAPI, Spring, Rails, and ASP.NET. The REST and gRPC APIs are language-agnostic for anything not on that list — including Rust, Elixir, and PHP, which several customers run today against the raw API.

PIIsafe authenticates engineers and operators against your IdP via SAML 2.0, OIDC, or SCIM. Roles and groups in your IdP map to PIIsafe roles, so off-boarding in your IdP immediately removes access in PIIsafe. Service-to-service authentication uses mTLS or signed JWTs depending on what your services already speak.

Yes. The bulk-tokenization endpoints, plus migration helpers for AWS KMS, Google Cloud KMS, Azure Key Vault, HashiCorp Vault, Skyflow, and homegrown column-level encryption, let you move historical data without downtime. Recurring jobs can run alongside your existing system during a cutover, then be flipped at a single config switch.

Yes. A signed Docker image runs a real PIIsafe vault on a developer laptop with seeded test data. The local instance speaks the same APIs, emits the same audit log, and obeys the same policies — so the path from idea to PR never depends on the staging environment.

Yes. The prompt-time SDK scrubs PII out of prompts before they hit a third-party model and reinserts the right value into the response, so the model never sees plaintext customer data. The same flow works for embeddings going into a vector store: tokenize first, embed second, and detokenize at retrieval according to policy.

Bulk tokenization replaces names, IDs, and contact information with stable tokens before data ever reaches a fine-tuning job. Tokens preserve uniqueness, so the model still learns the structure of the data — but the underlying values are not in the training set or the resulting weights.

No. PIIsafe does not train any models on customer data — ours or third parties'. There is no opt-out checkbox because the option does not exist. This is also written into the Data Processing Agreement.

Yes. The same access-policy engine that decides who can read a vault also decides who can detokenize values returned by a model. So if an LLM hallucinates plaintext into a response, your application still cannot resolve it without an authorized policy match.

PIIsafe targets 99.99% availability for the hosted product, with multi-AZ active-active deployments for cryptographic operations. The status page publishes real-time uptime, incident history, and post-incident reviews.

Encrypted data and audit logs are continuously replicated across availability zones in the chosen region, with point-in-time restore. Customers in dedicated and self-hosted plans can configure cross-region failover within their compliance constraints. Recovery objectives (RTO 1 hour, RPO 5 minutes) are written into the SLA, not aspirational.

Every plan includes documentation, tutorials, and email support. Paid plans add a private Slack channel with engineering on-call; enterprise adds a named technical account manager and a 1-hour incident response SLA, plus quarterly architecture reviews.

Email security@piisafe.com or use the responsible-disclosure form on our trust page. We acknowledge reports within one business day, triage within three, and publish post-incident reviews when issues are resolved. Responsible researchers are credited on the security page and (where applicable) eligible for our bounty program.

If we ever detect unauthorized access to a vault, you hear from a real engineer within 24 hours — with what we know, what we do not, and what we are doing about it. The notification clock starts on detection, not on conclusion of investigation.