Security & Vendor Review Packet

Security at Debt Digest.

In plain terms: how we keep your data safe, on one page. The technical detail below is written for your security and procurement team: encryption, sub-processors, architecture, certifications, and audit posture. Save this page as PDF and bring it to your security committee.

Effective
Review cadence
Quarterly
Version
1.4
Trust center
Entity
Debt Digest, Inc. (DE C-Corp)
Operating role
Receivables workflow platform
Data residency
US-East (single region)
Encryption
TLS 1.3 / AES-256

§ 2 Control summary

Headline control counts as of the effective date above: every status pill on this page, counted. The bulk are enumerated in § 4 Encryption & controls, with the rest in § 3 certifications, § 5 architecture, and § 6 access and BC/DR. Status definitions: Implemented = wired into production code and verifiable in the repository. Scheduled = dated and assigned. Planned = roadmap, not yet scheduled.

Control posture

Implemented20
Scheduled7
Planned2

§ 3 Certifications & audits

Debt Digest does not yet hold an independent SOC 2 attestation. SOC 2 is in progress; compliance certifications scale with the customers we onboard. Sub-processors (§ 7) carry their own current attestations; those are the controls a vendor-risk reviewer should rely on for hosted infrastructure today.

Audit posture today

ItemStatus
SOC 2Readiness in-house, no audit firm engaged
Third-party penetration testScheduled before first production pilot
Internal vulnerability scanningImplemented
Dependency scanning (CI)Implemented
SSO & SAML federation (Okta, Azure AD)On the roadmap
HIPAA BAA capabilityNot in scope for credit-union pilots

§ 4 Encryption & controls

Verifiable controls. Each row is wired in production code at the effective date and can be inspected by a designated reviewer on signed NDA. Repository: github.com/gvanderwolk/debt-digest-app.

Transport & cryptography

ControlImplementationStatus
Transport encryptionTLS 1.3, HSTS preload, no downgrade to TLS 1.1Implemented
Data at restAES-256, managed-Postgres keys, regional KMSImplemented
Password hashingscrypt (N=2^14, r=8, p=1) + 32-byte saltImplemented
Session tokensJWT HS256, 4-hour expiry, server-side revocation listImplemented
Webhook signingHMAC-SHA256, per-creditor secret, replay window 5 minImplemented

Application controls

ControlImplementationStatus
Security headersCSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-PolicyImplemented
Rate limiting60 req/min general, 5 req/min auth, progressive lockoutImplemented
Input validationServer-side schema validation on every route, parameterized SQLImplemented
IdempotencyIdempotency-Key header on every payment + placement endpointImplemented
Tenant scope enforcementCreditor ID injected from JWT, never from request bodyImplemented
CORS allowlistStrict origin allowlist in production; no wildcardImplemented

Audit & observability

ControlImplementationStatus
Audit logAppend-only, hash-chained per row, CSV export per creditorImplemented
Application logsManaged log drain, 30-day retention, PII-scrubbedImplemented
Database backupsManaged-Postgres point-in-time recovery, 7-day window, regional replicasImplemented
SIEM forwardingLog export to creditor SIEM (Splunk, Datadog) via webhookOn the roadmap
Secrets managementHosted env-var scope, no secrets in repository, rotation on offboardImplemented

Identity & access

ControlImplementationStatus
Role-based accessRoles: consumer, creditor, firm, staff. JWT-bound, server-enforced.Implemented
MFA on staff & creditor adminTOTP enrollment required on staff accounts; rolling out to creditor adminImplemented (partial)
SSO / SAMLOkta and Azure AD via standard SAML 2.0 metadataOn the roadmap
Production DB accessFounder-only today. Break-glass logged. Rotated on every hire.Implemented

§ 5 Regulatory coverage

Role-aware controls available in product. Applicability depends on the participant, account, communication, and jurisdiction; configuration and counsel approval remain required.

FDCPA §809(a) Applicable validation-notice workflow FDCPA §805(a)(2) Counsel-retained firewall, outreach halt FDCPA §1692c(c) One-click cease-communication FDCPA §809(b) Consumer response window; verification-gated hold Reg F §1006.6 8am-9pm consumer local time Reg F §1006.34 Applicable validation information and itemization NCUA 12 CFR 741.3 120 DPD charge-off boundary (credit unions) FFIEC URCC 180/120 DPD charge-off boundary (banks) GLBA Safeguards Rule Member-NPI handling CCPA / CPRA Consumer access & deletion routes

Debt Digest charges platform participants monthly subscriptions determined by their selected plan and eligible subscription units. Billing is independent of collection or resolution outcomes.

§ 6 Architecture & data flow

Single-region deployment. One origin, one cookie scope, one CSP. Sub-processors are enumerated in § 7.

Creditor CSV / API / portal Consumer Portal · JWT auth Debt Digest API US-East TLS 1.3 · HSTS preload Managed Postgres US-East · AES-256 Audit log Append-only · hashed Payment processor PCI-DSS L1 · HMAC TLS 1.3 TLS 1.3 + JWT SQL/TLS write-once HMAC webhook

Network boundary

Single hosted origin (debt-digest.com). No third-party static host, no split-brain. Edge DDoS protection in front.

Tenant isolation

Logical isolation via creditor_id column scoping. Every query gated by a server-side tenant guard. Cross-tenant read is rejected before the database is reached.

Region & failover

US-East single region. Managed-Postgres point-in-time recovery 7 days. RTO 4 hours, RPO 15 minutes. Multi-region replication On the roadmap.

PII scope

Last-4 SSN where identity verification requires it. Full SSN is never requested for servicing. Member NPI scoped to the placing creditor.

§ 7 Sub-processors

Every third party with technical access to creditor or consumer data falls into the categories below. Each named sub-processor is disclosed by name in the diligence packet under NDA and in the pilot agreement.

CategoryRoleRegionPosture
Application computeContainer hosting, deploy pipeline, log drainUS-EastSOC 2 Type II
Managed databasePostgreSQL, point-in-time recoveryUS-EastSOC 2 Type II
Edge / DDoS protectionDNS, edge DDoS protection, WAFGlobalSOC 2 Type II · ISO 27001
Payment processingPCI-compliant payment processing for subscription invoicingMulti-regionPCI-DSS Level 1 · SOC 2 Type II
Transactional email and SMSFDCPA notices and member outreach deliveryUS-multi-regionSOC 2 Type II · ISO 27001
Application error trackingPII scrubbed on captureUSSOC 2 Type II
Source control and CISource code and CI/CD with scoped secretsUSSOC 2 Type II · ISO 27001

A signed DPA is in place with every sub-processor that handles PII. The named sub-processor list and links to each sub-processor’s current attestations are provided to creditors under NDA in the diligence packet. New sub-processors trigger 30-day creditor notice per pilot agreement.

§ 8 Funds-flow firewall

In currently activated direct-payment workflows, consumer funds do not flow through Debt Digest accounts. The platform records the account owner, authorized payee, operating participants, sender, and decision-maker separately. Funds flow is an important control, but it does not by itself decide any participant's legal status.

Consumer

Pays the creditor directly through the creditor's existing payment rail.

Creditor

Receives funds. Member-funds firewall

Debt Digest

Monthly subscription invoice based on active accounts under management or seats. Billing is independent of collection or resolution outcomes.

PCI-compliant payment processing is used for Debt Digest subscription invoicing. In the activated direct-payment workflow, consumer payment instruments do not touch Debt Digest infrastructure; funds go to the identified account owner or authorized payee on that participant's rail.

§ 9 Data handling & retention

TopicDetail
Data minimizationLast-4 SSN where identity verification requires it. Full SSN is never collected for servicing. Member-NPI scoped to placing creditor.
No sale, no sharing across tenantsPII firewalls enforced at the database query layer via tenant scope. Each creditor sees only its own data.
Retention (active accounts)Life of pilot plus regulatory minimums per FDCPA and applicable state record-keeping rules.
Retention (closed accounts)Anonymized 7 years after closure. Identifiers stripped; transaction history retained for audit only.
Creditor exportFull audit log and portfolio data exportable as CSV at any time, no gating. Self-serve from the dashboard.
Pilot wind-downFull data export plus scheduled deletion timeline included in pilot agreement. Default: 30-day cool-down, then irreversible purge.
Consumer rights routesAccess, correction, and deletion requests routed through /api/consumer/rights. Verified within 30 days per CCPA / CPRA.
Right to disputeFor covered accounts, the 30-day FDCPA period is the consumer response window. A timely qualifying dispute remains held until verification is sent; elapsed time alone does not release it.

§ 10 Incident response

  • Detection. Application errors paged via our error-tracking service. Failed-auth spikes alert on the hosted log drain. Anomalous data-export volumes alert on the Postgres slow-query log.
  • Containment SLO. First response within 1 hour during business hours, 4 hours after-hours.
  • Notification. Written notice to the creditor contact-of-record within 72 hours of detection (GDPR / NCUA-aligned), and earlier if material harm is identified.
  • Post-incident report. Within 30 days: root cause, scope, remediation, prevention. Shared as a written report and reviewed on a creditor call.
  • Direct access. Creditor's security lead has direct access to the incident-response engineer during the active window. No support-ticket routing.
  • Coordinated disclosure. Researchers can report via /.well-known/security.txt per RFC 9116, which publishes the disclosure contact and policy.

Security contact: security@debt-digest.com. Out-of-band escalation contact is included in the executed pilot agreement.

§ 11 Access & business continuity

ItemPosture
Production database accessFounder-only today. Credential rotation on every hire. Break-glass logged to the audit table.
Background checksRequired for any future hire with production access. SSAE-compliant vendor.
Acceptable Use & Code of ConductSigned at onboarding. Annual reaffirmation.
RTO4 hours for full service restoration.
RPO15 minutes via managed-Postgres point-in-time recovery.
Continuity (founder unavailable)Break-glass access procedure documented with one external trustee. Expanded with first hire.
Disaster recovery drillAnnual tabletop. First drill On the roadmap.

§ 12 Documentation

Linked references for technical reviewers. Each document below is current as of the effective date.

§ 13 Document changelog

v1.42026-07-24: Corrected counsel and assurance status. Counsel of record restated: outside compliance counsel is retained at defined triggers, the first of which is a first pilot signature, rather than listed in a data room. SOC 2 restated as in-house readiness with no audit firm engaged, and the third-party penetration test as scheduled before first production pilot, so this packet matches the Trust Center rather than reading as engagements already underway. Removed a PGP-key reference: security.txt publishes a disclosure contact and policy, no encryption key.
v1.32026-05-18: Vendor-packet refactor. Added control table, sub-processor categories, architecture diagram, doc tiles, changelog. Aligned with shared design system.
v1.22026-05-01: Compliance posture refresh. Sub-processor section added.
v1.12026-04-15: Statute citations expanded. Funds-flow firewall section added.
v1.02026-04-06: Initial publication.