Compliance & Security

Your Data Is Bankruptcy-Sensitive.
We Treat It That Way.

PVL handles court filings, trustee ledgers, and portfolio tapes containing PII and sensitive financial data. Our security infrastructure is built to meet the standards institutional buyers expect.

AES-256 Encryption at Rest
TLS 1.3 in Transit
SOC 2 Type II Aligned
Role-Based Access Controls
Security Posture

Built for Sensitive Financial Data

Every layer of PVL's infrastructure is designed to protect the bankruptcy data, PII, and portfolio analytics that flow through our platform.

Encryption Everywhere

All data encrypted with AES-256 at rest and TLS 1.3 in transit. Portfolio tapes and trustee ledgers never exist in plaintext outside of active processing.

Access Controls

Role-based access with least-privilege defaults. Every data request is authenticated, authorized, and logged. No shared credentials, no ambient access.

Full Audit Trail

Every file upload, valuation run, and data export is logged with timestamp, user identity, and action type. Your compliance team can audit any interaction.

Data Handling

How We Protect Your Portfolio Data

From the moment a tape is uploaded to the final deliverable, every step follows strict data handling protocols.

Ingestion

Secure Upload & Processing

Portfolio tapes are uploaded via encrypted channels and processed in isolated compute environments. Files are validated on receipt, and malformed or unexpected data formats are rejected before processing begins.

  • Uploads transmitted over TLS 1.3 with certificate pinning
  • Files scanned for malware and format anomalies before ingestion
  • Processing occurs in ephemeral, isolated compute containers
  • Raw uploads are purged after processing completes (configurable retention)
Storage

Encryption & Isolation

All stored data — including trustee ledgers, valuation outputs, and client configurations — is encrypted at rest using AES-256. Each client's data is logically isolated with tenant-scoped encryption keys.

  • AES-256 encryption at rest with per-tenant key management
  • Logical data isolation between client environments
  • Automated key rotation on a defined schedule
  • Backup data encrypted with the same standards as primary storage
Delivery

Secure Output & Retention

Valuation packages are delivered through authenticated, encrypted channels. Clients control their own retention policies, and all data can be permanently purged on request.

  • Deliverables accessible only via authenticated sessions
  • Configurable data retention periods per client agreement
  • Permanent data deletion available on request with confirmation
  • Download activity logged in the audit trail
Regulatory Alignment

Compliance Standards We Follow

PVL operates at the intersection of bankruptcy data and financial analytics. We align our practices with the frameworks that matter to institutional buyers.

SOC 2 Type II Alignment

Our controls are designed around the SOC 2 Trust Service Criteria — security, availability, and confidentiality. We maintain documentation and evidence ready for auditor review.

GLBA & Financial Privacy

We handle consumer financial data in accordance with Gramm-Leach-Bliley Act safeguard requirements, including administrative, technical, and physical safeguards for nonpublic personal information.

Bankruptcy Data Governance

Court filings and trustee data accessed through authorized channels. We maintain strict controls on PII handling, including debtor names, case numbers, and financial details within Chapter 13 records.

Incident Response

Documented incident response plan with defined escalation paths. Clients are notified within 72 hours of any confirmed data incident, with full root-cause analysis and remediation timeline provided.

Infrastructure

Platform Security Details

Network Security

All traffic routed through WAF-protected endpoints. Internal services communicate over private networks with mutual TLS. No public-facing database endpoints.

Identity & Authentication

Multi-factor authentication required for all platform access. Session tokens are short-lived and scoped to specific permissions. SSO integration available for enterprise clients.

Monitoring & Alerting

Continuous monitoring of access patterns, API usage, and system health. Anomalous activity triggers automated alerts. Security logs retained for a minimum of 12 months.

Security Review

Need More Detail?

We're happy to share our security documentation, answer vendor assessment questionnaires, or schedule a call with our team to walk through our compliance posture.

Request Security Review Back to Platform