What PIToolkit can and cannot see

The short version

Your case material is encrypted in your browser, with keys that come from your password, before it reaches our servers. We store it encrypted and hold no key that opens it. That protects it from anyone who gets into our database, file storage or backups, including our own staff. It doesn’t protect you if the code your browser loads from us has been tampered with.

Some information isn’t encrypted, because PIToolkit needs it to run your account, enforce your plan, or show things before anything is unlocked. This page lists both sides as precisely as we can.

What stays encrypted (PIToolkit can’t read it)

Case names and descriptions
Case notes
Contact details: names, emails, phone numbers, companies and notes
Evidence files, their names, their SHA-256 fingerprints, and their capture details (capture time, location and device identifier)
Report text
Secure messages
Time entry descriptions
Your clients’ names, if they give one in the portal
Your password, your recovery key and every encryption key
What you search for. Search sends a scrambled fingerprint of your search term, not the term itself.

What PIToolkit’s servers can read

Your account

The email address you sign in with
When you accepted our terms and which version, and when you confirmed your licence
Your plan

Your workspace settings and branding

Your business name, logo and brand colours, because they appear on portal pages and in emails
Your workspace defaults: default billing rate, default case type and time zone

Information about your records, not their content

For each case: its type (surveillance, background check and so on), its phase, its case reference, and its dates
For each contact: their role (client, subject, witness and so on), and their role on each case
For each evidence file: its file type and size
For each message: who sent it and when
For each time entry: its date, duration and billing rate, and when a timer started and stopped. This is the main exception to encryption today. A planned update moves these into encrypted fields.

Your clients’ portal accounts

The email address each client signs in with, and the address you sent an invitation to. After the client accepts, the invitation address is cleared once you answer the review card in Contacts; if the client didn’t give a name, there’s no card and it’s kept

Security and sign-in records

For each signed-in session: the network (IP) address and a description of the browser it came from
A scrambled fingerprint of your account, browser and network, used to spot sign-ins from a new device
Your activity log: what happened, to which kind of record (by id) and when. It never contains case content. You can read and export it yourself. See Your activity log.

Product usage

Which parts of the product were used, such as page views, features used and when you reached a plan limit. Individual events are kept for about 90 days, then combined into daily totals for your workspace. No analytics company, tracking script or advertising network is involved.

Support requests

Anything you write in a support request. PIToolkit support can read it, and the support form tells you so before you type. Don’t include case details. See Contacting support.

What this means if someone demands your data

A demand served on PIToolkit could only produce what’s in the “can read” list above, plus encrypted material we have no way to open.

What PIToolkit staff can and can’t do

Our staff tools let us see accounts by internal id, with their plan, storage used, number of cases by phase and account state; see security alerts such as repeated failed sign-ins; and read and reply to support requests.

There’s no tool on our side to:

read your case content
reset your password, your recovery key or your second factor
sign in as you
start, speed up or cancel your account deletion

This means that if you lose your password and recovery key, or your second factor and backup codes, we can’t get you back in. See Your recovery kit.

Your export

When you export your data, the archive is built and decrypted in your browser. The file you download is a normal, unencrypted ZIP, so store it somewhere safe. See Exporting your data.