The information your customers share — names, payment details, medical histories, identifiers — is the most sensitive thing they will ever hand to a piece of software. PIIsafe is built so that storing it never quietly becomes the riskiest decision your team made this year.
Why we exist
Most data breaches are not the result of a clever attack. They are the result of a small detail nobody had time to think about: a logged plaintext field, a backup that was never encrypted, an internal tool that quietly stored too much.
PIIsafe is the platform we wished existed when we were running those incidents. Encryption is the easy part. Doing it consistently across an organization, surviving the auditor question that arrives at 4 p.m. on a Friday, and erasing a customer in a way that holds up — that is the work we are here to take off your team's plate.
The pillars
Your data is encrypted in your browser or service before it reaches a PIIsafe server. We never see plaintext outside an encrypted memory boundary, and we never write it to disk or to logs.
PIIsafe was designed so that the most sensitive part of the system — the master key — is yours. With customer-managed and hold-your-own-key configurations, revoking access in your KMS makes the data unreadable, even to PIIsafe.
Engineers do not have standing access to your data. Every read is governed by a policy, every elevated action requires a reason, and every step is recorded in a tamper-evident log you can replicate to your own systems.
PIIsafe is built around the assumption that data subjects have rights — to know, to download, to be forgotten — and that those rights should be a one-line API call rather than a six-week project.
What we promise
Plain English, no asterisks. These are commitments to the engineer reading this page and to the customer who will never see it.
PIIsafe is the platform you use to protect customer data — but it never becomes the relationship. We do not contact your customers, do not market to them, and do not appear in any user-facing flow unless you choose to put us there. Your customers gave their data to you, not to us.
Customer data passing through PIIsafe is never sold to a third party, never shared with an advertising network, and never used to train any AI model — ours or anyone else's. There is no opt-out checkbox because the option does not exist; the prohibition is written into the Data Processing Agreement.
When sensitive data enters PIIsafe, it is encrypted with a unique key wrapped by your master key before it ever reaches durable storage. Backups, replicas, and disaster-recovery copies contain only ciphertext. Without your master key, even a complete copy of our database is mathematically useless.
Your tokens, your ciphertext, and your audit log are yours. Export them at any time, in formats designed for migration — not lock-in. We will help with the migration; we will not hold the door closed.
Every infrastructure or analytics sub-processor is published on this page. If we add or change one, you hear about it 30 days ahead — not in a footnote on a renewal email.
If we ever detect unauthorized access to a vault, you hear from a real engineer within 24 hours of detection — with what we know, what we do not, and what we are doing about it. The notification clock starts on detection, not on the conclusion of an investigation.
The numbers that matter
Plaintext stored
Ciphertext only — even in our backups.
Records under your key
Customer-managed and HYOK supported.
Breach notification
Clock starts on detection, not investigation.
Models trained on your data
Now or ever — written into the DPA.
The journey of one record
Privacy is not a slide deck. It is a set of mechanical guarantees that have to hold, in order, every single time.
Sensitive fields are encrypted in the browser or service that captures them, using a key wrapped by your master key. Plaintext never crosses the wire in the clear, never lands in an access log, and never sits in a queue.
PIIsafe writes ciphertext and a wrapped data key to region-pinned storage. Your application keeps a token — not the value — for everything that follows. The database, the backups, and the replicas all contain the same useless bytes.
When a system needs the value, it requests detokenization. Policy decides — based on identity, context, MFA strength, and stated purpose — whether to release plaintext, a redacted variant, or nothing at all. The request is logged before it is answered.
Every access is recorded in a tamper-evident log streamable to your SIEM. When retention expires or a subject asks to be forgotten, the data key is destroyed and the ciphertext becomes mathematically unrecoverable — while accounting totals stay intact.
Compliance roadmap
We don't claim certifications we haven't earned. PIIsafe is engineered against these frameworks today, with formal audits scheduled. As each one completes, this page is updated and the report is published in the customer trust portal.
Independent annual audit covering security, availability, confidentiality, and privacy.
Information security management system audited against the international standard.
Configurable HIPAA-aligned deployment, with a Business Associate Agreement available.
Region-pinned vaults, processor agreements, and data subject request automation.
Honest answers
For the typical workload, yes — and not because PIIsafe is mysteriously secure, but because the boundary where sensitive data is handled becomes one well-tested system instead of every service in your stack. Your application servers stop holding plaintext; your engineers stop having standing access; your backups stop being a credential vault. The places things historically went wrong are the places that disappear.
Not in the configurations we recommend. With customer-managed keys, decryption requires your KMS to authorize the operation; with hold-your-own-key, your HSM must sign every wrap and unwrap. PIIsafe staff have no standing access to plaintext, and the platform-managed-key configuration restricts plaintext to ephemeral, sealed memory under multi-sig controls. The audit log records every access whether or not it was technically possible.
Your tokens, ciphertext, and audit logs are yours and exportable at any time, in standard formats. We publish migration guides for the major destinations — including back to a self-hosted vault — and the open-source SDKs continue to read exports even without a server to talk to. The relationship is structured so that "leaving" is always a viable plan, not just a promise.
No. PIIsafe does not train any AI model on customer data, and customer data is never shared with a third-party model provider. There is no opt-in form. The prompt-time SDK exists precisely so that when you do use AI on data that lives in PIIsafe, the model never sees plaintext either.
Every read, write, key operation, and policy change lands in a tamper-evident audit log. Stream it to Splunk, Datadog, Snowflake, or BigQuery in real time, or query it from the dashboard. The log is chained — a single edit is detectable — and it is the same log we use to satisfy our own compliance program.
Send the erasure API call with the subject ID. The data key is destroyed across vaults, replicas, and backups — usually in seconds, with a hard guarantee within minutes — and a signed report is generated for your privacy team or for the customer themselves. Accounting totals survive; the underlying data does not.
What you can ask for today
Formal certifications are still in flight, but the underlying engineering and documentation are ready today. Email security@piisafe.com and we will share the materials below under NDA — no chasing required.
We will walk you through how PIIsafe protects your specific use case — payments, health, HR, AI training data — and answer the questions your security team is going to ask anyway.