Security at Debt Digest.
In plain terms: how we keep your data safe, on one page. The technical detail below is written for your security and procurement team: encryption, sub-processors, architecture, certifications, and audit posture. Save this page as PDF and bring it to your security committee.
§ 1 Legal structure
| Field | Value |
|---|---|
| Legal entity | Debt Digest, Inc. Delaware C-Corporation, formed April 2026. EIN issued. |
| Operating role | Shared receivables workflow platform. Debt Digest hosts account data, enforces configured workflow controls, and records participant actions. This operating description is not a categorical legal classification; duties depend on actual conduct, authority, contracts, account context, jurisdiction, and applicable law. |
| Licensed footprint | Licensing and conduct requirements are evaluated by participant type, workflow, account, communication, and jurisdiction. No state exemption or filing decision is assumed from a platform label. The current analysis and open counsel gates are published at /legal. |
| Money handling | The customer pays the creditor directly. The creditor remits Debt Digest's platform subscription quarterly. Debt Digest does not hold, route, or custody consumer funds. |
| Counsel of record | Outside compliance counsel engagement is in progress; counsel is retained at defined triggers, the first of which is a first pilot signature. Current status and open counsel gates are published at /trust. |
| Insurance | E&O and cyber liability binders Scheduled for first production pilot. Carrier and limits provided on signed NDA. |
§ 2 Control summary
Headline control counts as of the effective date above: every status pill on this page, counted. The bulk are enumerated in § 4 Encryption & controls, with the rest in § 3 certifications, § 5 architecture, and § 6 access and BC/DR. Status definitions: Implemented = wired into production code and verifiable in the repository. Scheduled = dated and assigned. Planned = roadmap, not yet scheduled.
Control posture summary
Control posture
§ 3 Certifications & audits
Debt Digest does not yet hold an independent SOC 2 attestation. SOC 2 is in progress; compliance certifications scale with the customers we onboard. Sub-processors (§ 7) carry their own current attestations; those are the controls a vendor-risk reviewer should rely on for hosted infrastructure today.
Audit posture today
| Item | Status |
|---|---|
| SOC 2 | Readiness in-house, no audit firm engaged |
| Third-party penetration test | Scheduled before first production pilot |
| Internal vulnerability scanning | Implemented |
| Dependency scanning (CI) | Implemented |
| SSO & SAML federation (Okta, Azure AD) | On the roadmap |
| HIPAA BAA capability | Not in scope for credit-union pilots |
§ 4 Encryption & controls
Verifiable controls. Each row is wired in production code at the effective date and can be inspected by a designated reviewer on signed NDA. Repository: github.com/gvanderwolk/debt-digest-app.
Transport & cryptography
| Control | Implementation | Status |
|---|---|---|
| Transport encryption | TLS 1.3, HSTS preload, no downgrade to TLS 1.1 | Implemented |
| Data at rest | AES-256, managed-Postgres keys, regional KMS | Implemented |
| Password hashing | scrypt (N=2^14, r=8, p=1) + 32-byte salt | Implemented |
| Session tokens | JWT HS256, 4-hour expiry, server-side revocation list | Implemented |
| Webhook signing | HMAC-SHA256, per-creditor secret, replay window 5 min | Implemented |
Application controls
| Control | Implementation | Status |
|---|---|---|
| Security headers | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy | Implemented |
| Rate limiting | 60 req/min general, 5 req/min auth, progressive lockout | Implemented |
| Input validation | Server-side schema validation on every route, parameterized SQL | Implemented |
| Idempotency | Idempotency-Key header on every payment + placement endpoint | Implemented |
| Tenant scope enforcement | Creditor ID injected from JWT, never from request body | Implemented |
| CORS allowlist | Strict origin allowlist in production; no wildcard | Implemented |
Audit & observability
| Control | Implementation | Status |
|---|---|---|
| Audit log | Append-only, hash-chained per row, CSV export per creditor | Implemented |
| Application logs | Managed log drain, 30-day retention, PII-scrubbed | Implemented |
| Database backups | Managed-Postgres point-in-time recovery, 7-day window, regional replicas | Implemented |
| SIEM forwarding | Log export to creditor SIEM (Splunk, Datadog) via webhook | On the roadmap |
| Secrets management | Hosted env-var scope, no secrets in repository, rotation on offboard | Implemented |
Identity & access
| Control | Implementation | Status |
|---|---|---|
| Role-based access | Roles: consumer, creditor, firm, staff. JWT-bound, server-enforced. | Implemented |
| MFA on staff & creditor admin | TOTP enrollment required on staff accounts; rolling out to creditor admin | Implemented (partial) |
| SSO / SAML | Okta and Azure AD via standard SAML 2.0 metadata | On the roadmap |
| Production DB access | Founder-only today. Break-glass logged. Rotated on every hire. | Implemented |
§ 5 Regulatory coverage
Role-aware controls available in product. Applicability depends on the participant, account, communication, and jurisdiction; configuration and counsel approval remain required.
FDCPA §809(a) Applicable validation-notice workflow
FDCPA §805(a)(2) Counsel-retained firewall, outreach halt
FDCPA §1692c(c) One-click cease-communication
FDCPA §809(b) Consumer response window; verification-gated hold
Reg F §1006.6 8am-9pm consumer local time
Reg F §1006.34 Applicable validation information and itemization
NCUA 12 CFR 741.3 120 DPD charge-off boundary (credit unions)
FFIEC URCC 180/120 DPD charge-off boundary (banks)
GLBA Safeguards Rule Member-NPI handling
CCPA / CPRA Consumer access & deletion routes
Debt Digest charges platform participants monthly subscriptions determined by their selected plan and eligible subscription units. Billing is independent of collection or resolution outcomes.
§ 6 Architecture & data flow
Single-region deployment. One origin, one cookie scope, one CSP. Sub-processors are enumerated in § 7.
Architecture reference
Network boundary
Single hosted origin (debt-digest.com). No third-party static host, no split-brain. Edge DDoS protection in front.
Tenant isolation
Logical isolation via creditor_id column scoping. Every query gated by a server-side tenant guard. Cross-tenant read is rejected before the database is reached.
Region & failover
US-East single region. Managed-Postgres point-in-time recovery 7 days. RTO 4 hours, RPO 15 minutes. Multi-region replication On the roadmap.
PII scope
Last-4 SSN where identity verification requires it. Full SSN is never requested for servicing. Member NPI scoped to the placing creditor.
§ 7 Sub-processors
Every third party with technical access to creditor or consumer data falls into the categories below. Each named sub-processor is disclosed by name in the diligence packet under NDA and in the pilot agreement. These five category rows map to six named providers in the DPA: Stripe, SendGrid (Twilio), Twilio (SMS), Neon, Railway, and GitHub.
| Category | Role | Region | Posture |
|---|---|---|---|
| Application compute and edge | Container hosting, deploy pipeline, log drain, and the edge layer that terminates TLS and absorbs volumetric traffic. This is one provider, not two: we do not run a separate CDN or WAF vendor in front of it. Authoritative DNS is a separate vendor and is named below. | US-East (application and database); edge PoPs global | SOC 2 Type II |
| Managed database | PostgreSQL, point-in-time recovery | US-East | SOC 2 Type II |
| Payment processing (selected, not yet enabled) | PCI-compliant processing for Debt Digest subscription invoicing. No production credential is configured, so this provider receives no data today and the platform reports payment processing as simulated. | Multi-region | PCI-DSS Level 1 · SOC 2 Type II |
| Transactional email and SMS (selected, not yet enabled) | Notice and outreach delivery. No production credential is configured, so these providers receive no data today and notices sit in a manually released queue. | US-multi-region | SOC 2 Type II · ISO 27001 |
| Source control and CI | Source code and CI/CD with scoped secrets | US | SOC 2 Type II · ISO 27001 |
Three of these five receive data today: application compute and edge, the managed database, and source control and CI. The other two are selected and contracted but have no production credential configured, so no data reaches them; this matches the platform-state disclosure in our pilot agreement, which records notice delivery as a manually released queue and payment processing as simulated. Each provider that receives data is engaged under that provider’s data processing addendum, which we accept as a condition of use. We run no separate error-tracking, application-performance-monitoring, session-replay, product-analytics, or advertising sub-processor: error reporting is environment-gated and currently writes to our own server logs, so no third party receives it. Two code paths would route data to an artificial-intelligence model provider (optical character recognition of a consumer-uploaded document, and an internal advisory agent surface). Both are disabled in the production configuration and ship disabled by default; enabling either adds a sub-processor and requires 30 days written notice. We run no separate CDN or web-application-firewall provider in front of the application; the edge is our compute provider’s own. Authoritative DNS for our domain is hosted at Google Cloud DNS, which resolves names only and receives no creditor or consumer data. The named sub-processor list and links to each sub-processor’s current attestations are provided to creditors under NDA in the diligence packet. New sub-processors trigger 30-day creditor notice per pilot agreement.
§ 8 Funds-flow firewall
In currently activated direct-payment workflows, consumer funds do not flow through Debt Digest accounts. The platform records the account owner, authorized payee, operating participants, sender, and decision-maker separately. Funds flow is an important control, but it does not by itself decide any participant's legal status.
How funds move
Consumer
Pays the creditor directly through the creditor's existing payment rail.
Creditor
Receives funds. Member-funds firewall
Debt Digest
Monthly subscription invoice based on active accounts under management or seats. Billing is independent of collection or resolution outcomes.
PCI-compliant payment processing is used for Debt Digest subscription invoicing. In the activated direct-payment workflow, consumer payment instruments do not touch Debt Digest infrastructure; funds go to the identified account owner or authorized payee on that participant's rail.
§ 9 Data handling & retention
| Topic | Detail |
|---|---|
| Data minimization | Last-4 SSN where identity verification requires it. Full SSN is never collected for servicing. Member-NPI scoped to placing creditor. |
| No sale, no sharing across tenants | PII firewalls enforced at the database query layer via tenant scope. Each creditor sees only its own data. |
| Retention (active accounts) | Life of pilot plus regulatory minimums per FDCPA and applicable state record-keeping rules. |
| Retention (closed accounts) | Anonymized 7 years after closure. Identifiers stripped; transaction history retained for audit only. |
| Creditor export | Full audit log and portfolio data exportable as CSV at any time, no gating. Self-serve from the dashboard. |
| Pilot wind-down | Full data export plus scheduled deletion timeline included in pilot agreement. Default: 30-day cool-down, then irreversible purge. |
| Consumer rights routes | Access, correction, and deletion requests routed through /api/consumer/rights. Verified within 30 days per CCPA / CPRA. |
| Right to dispute | For covered accounts, the 30-day FDCPA period is the consumer response window. A timely qualifying dispute remains held until verification is sent; elapsed time alone does not release it. |
§ 10 Incident response
- Detection. Application errors paged via our error-tracking service. Failed-auth spikes alert on the hosted log drain. Anomalous data-export volumes alert on the Postgres slow-query log.
- Containment SLO. First response within 1 hour during business hours, 4 hours after-hours.
- Notification. Written notice to the creditor contact-of-record within 72 hours of detection (GDPR / NCUA-aligned), and earlier if material harm is identified.
- Post-incident report. Within 30 days: root cause, scope, remediation, prevention. Shared as a written report and reviewed on a creditor call.
- Direct access. Creditor's security lead has direct access to the incident-response engineer during the active window. No support-ticket routing.
- Coordinated disclosure. Researchers can report via
/.well-known/security.txtper RFC 9116, which publishes the disclosure contact and policy.
Security contact: security@debt-digest.com. Out-of-band escalation contact is included in the executed pilot agreement.
§ 11 Access & business continuity
| Item | Posture |
|---|---|
| Production database access | Founder-only today. Credential rotation on every hire. Break-glass logged to the audit table. |
| Background checks | Required for any future hire with production access. SSAE-compliant vendor. |
| Acceptable Use & Code of Conduct | Signed at onboarding. Annual reaffirmation. |
| RTO | 4 hours for full service restoration. |
| RPO | 15 minutes via managed-Postgres point-in-time recovery. |
| Continuity (founder unavailable) | Break-glass access procedure documented with one external trustee. Expanded with first hire. |
| Disaster recovery drill | Annual tabletop. First drill On the roadmap. |
§ 12 Documentation
Linked references for technical reviewers. Each document below is current as of the effective date.
Documentation
API reference
REST endpoints, JWT auth flow, error codes, rate limits.
Open →Webhook verification
HMAC-SHA256 signature validation, replay window, code snippets.
Open →CSV schema
Placement file format, field definitions, sample file.
Open →Legal & privacy
Privacy policy, terms of service, consumer rights, DPA template.
Open →Service levels
Uptime and response-time targets, and what is contractual today.
Open →Status
Live uptime, incident history, scheduled maintenance.
Open →Trust center
Posture page including open questions and regulatory roadmap.
Open →Pilot redlines
Request the pilot-agreement template for counsel review.
Email →