Pamkit security

Encryption in Transit and at Rest

Data is encrypted in transit with TLS 1.2+ (TLS 1.3 where supported) and at rest with AES-256. PAMKIT is not a zero-knowledge system: features such as OCR, search, and the Pamela assistant process your content on our servers under strict access controls.

Secure Data Storage

Your documents and personal information are stored on AWS and Supabase infrastructure, which maintain their own SOC 2 Type II certification.

Multi-Factor Authentication

Optional 2FA support to add an extra layer of security to your account.

Role-Based Access Control

Granular permissions system ensuring users only access what they need.

Regular Security Audits

Continuous monitoring and regular security assessments.

Built for GDPR & CCPA

Designed to meet GDPR and CCPA/CPRA requirements, including access, correction and deletion rights.

Strong Passwords

Use unique, complex passwords with at least 12 characters including numbers, symbols, and mixed case letters.

Device Security

Keep your devices secure to protect your account and data.

Account Monitoring

Regularly monitor your account for suspicious activity.

Network Security

Secure your internet connection to protect your data.

Service Organization Control 2

General Data Protection Regulation

California Consumer Privacy Act

Security Overview

At PAMKIT by Kollitech Corp., security is fundamental to everything we do. Our platform, "AI that remembers for you, so you don't have to!", is built on a foundation of trust and security. We employ industry-leading security practices to protect your valuable data, including assets, documents, and financial information.

We understand that you entrust us with sensitive information, and we take that responsibility seriously. Our security measures are designed with reference to GDPR, CCPA/CPRA, the SOC 2 Trust Services Criteria and ISO 27001 control families. PAMKIT is not certified under SOC 2 or ISO 27001.

This Security Policy outlines our comprehensive security practices, compliance standards, and your rights regarding data protection. We regularly review and update our security measures to address emerging threats and maintain the highest levels of protection.

Company: PAMKIT by Kollitech Corp., 1160 Battery Street East, Suite #100, San Francisco, CA 94111

Information Security Policy Governance

Policy Operationalization

Approved by management, our Information Security Policy is operationalized to identify, mitigate, and monitor information security risks relevant to our business. This policy is reviewed and updated annually or upon significant changes to our technical or business environment.

Risk Management

We maintain a comprehensive risk management program that includes:

Identification: Regular risk assessments and vulnerability scanning to identify potential threats to data confidentiality, integrity, and availability.
Mitigation: Implementation of technical and organizational controls to reduce identified risks to an acceptable level.
Monitoring: Continuous automated monitoring of our systems and networks to detect and respond to security events in real-time.

Roles and Responsibilities

Our security governance structure ensures accountability:

Security ownership: Security ownership sits with our engineering leadership.
Security Team: Executes daily security operations, monitoring, and incident response.
All Employees: Required to complete annual security awareness training and adhere to all security policies.

Identity & Access Management

Internal Access Controls

We implement rigorous controls to limit access to production assets and sensitive data, ensuring only authorized personnel have access:

Access Architecture

Role-Based Access Control (RBAC): Strict policies define access based on job function and need-to-know.

Role-Based Access Control (RBAC):

Authenticated Access: Authenticated, least-privilege access is required for every request to production systems.

Authenticated Access:

Centralized IAM: Unified identity management solution for consistent policy enforcement.

Lifecycle Management

Automated Provisioning: Access is automatically provisioned and de-provisioned based on employment status.

Automated Provisioning:

Immediate Revocation: Access is immediately revoked for terminated or transferred employees.

Immediate Revocation:

Periodic Audits: Regular reviews of user access rights to ensure continued appropriateness.

Non-Human & Service Access

We maintain strict security standards for service-to-service communication and automated processes:

OAuth Tokens & TLS: Use of OAuth tokens and TLS certificates for secure non-human authentication.
Secret Management: Secrets are managed via enterprise-grade key management systems, never hardcoded.

Our Security Features

PAMKIT employs multiple layers of security to protect your valuable data

Security Best Practices

Follow these guidelines to maximize your account security

Compliance & Certifications

PAMKIT designs its data protection and security program with reference to industry standards

Data Protection

Data Classification

We classify data based on sensitivity and implement appropriate protection measures:

Highly Sensitive: Financial data, personal identification numbers, authentication credentials - Highest level of encryption and access controls
Sensitive: Personal information, asset details, documents - Strong encryption and limited access
Internal: Usage analytics, system logs - Standard security measures
Public: Marketing content, public documentation - Basic security measures

Data Minimization

We collect and process only the data necessary to provide the Service. We do not collect unnecessary personal information and regularly review our data collection practices to ensure we're only collecting what's needed.

Data Access Controls

Access to user data is strictly controlled:

Role-based access control (RBAC) ensures employees only access data needed for their role
All data access is logged and monitored
Regular access reviews to ensure appropriate permissions
Principle of least privilege applied to all systems

Authentication & Access Control

User Authentication

We implement multiple layers of authentication security:

Password Requirements: Minimum 12 characters with lowercase, uppercase, a number and a symbol

Password Requirements:

Multi-Factor Authentication (MFA): Optional but recommended 2FA using authenticator apps or SMS

Multi-Factor Authentication (MFA):

OAuth Integration: Secure sign-in with Google and Apple
Session Management: Automatic session timeout and secure session tokens
Account Lockout: Temporary lockout after multiple failed login attempts

Access Control

Our access control system ensures users can only access authorized data:

Role-based permissions for different user types (owner, family member, advisor, etc.)
Granular document and asset sharing controls
Time-based access controls for shared documents
Audit logs for all data access and modifications

Encryption

Encryption in Transit

All data transmitted between your device and our servers is encrypted using:

TLS 1.2+: TLS 1.2 or higher for all web traffic, with TLS 1.3 where supported
HTTPS: All connections use HTTPS with strong cipher suites
TLS Validation: Mobile apps communicate only over TLS with system certificate validation
API Security: All API calls use authenticated, encrypted connections

Encryption at Rest

All data stored in our databases and file systems is encrypted:

AES-256: Industry-standard Advanced Encryption Standard with 256-bit keys
Database Encryption: All database fields containing sensitive data are encrypted

Database Encryption:

File Storage: Documents and files are encrypted before storage
Key Management: Encryption keys are managed using secure key management systems
Backup Encryption: All backups are encrypted using separate encryption keys

AI & Data Processing Security

AI Data Processing

PAMKIT uses AI technologies to power features like document categorization, natural language search, and predictive analytics; our current AI providers are listed in the Sub-Processors section of our Privacy Policy. All AI processing is conducted with strict security measures:

Server-Side Proxy: All AI API calls are proxied server-side in production and are never made directly from the client. API keys are never exposed to the browser.
Encrypted Data Transmission: All data sent to AI services is encrypted in transit using TLS 1.2+ (TLS 1.3 where supported)

Encrypted Data Transmission:

Data Minimization: Only necessary data is sent to AI services for processing
No Training on Customer Data: We do not use your data to train our own models, and we access AI providers under API terms that, by default, do not use customer inputs to train their models

No Training on Customer Data:

Limited Retention: AI inputs are not retained by our providers beyond what their zero-retention terms permit. Outputs we generate for you are retained per our Data Retention policy

Data Retention policy

Secure API Connections: All AI API calls use authenticated, encrypted connections

Secure API Connections:

Access Controls: AI processing is restricted to authorized systems only

Third-Party AI Providers

We work exclusively with AI providers that meet our rigorous security standards, currently Google (Gemini), xAI (Grok), OpenAI, and Anthropic (Claude), accessed only through PAMKIT's server-side proxy. Each is bound by a data processing agreement (DPA); see the Sub-Processors section of our Privacy Policy for the complete, current list.

All providers are contractually required to:

Comply with GDPR, CCPA, and other applicable data protection laws
Maintain a recognized independent security attestation or equivalent assurance program
Not use your data for training their models
Delete processing data upon completion of each request

Data Processing Transparency

You can view which AI services are processing your data and opt out of certain AI features through your account settings. However, some core features require AI processing and cannot be disabled.

Infrastructure Security

Our infrastructure is protected by multiple security layers:

Firewalls: Network firewalls restrict access to authorized traffic only
DDoS Protection: Distributed denial-of-service attack mitigation
Intrusion Detection: Real-time monitoring for suspicious network activity

Intrusion Detection:

Network Segmentation: Isolated network segments for different system components

Network Segmentation:

VPN Access: Administrative access requires VPN connection

Third-Party Infrastructure

We use industry-leading cloud providers (Supabase, AWS, etc.) that maintain:

SOC 2 Type II certification
ISO 27001 compliance
Regular security audits and penetration testing
Redundant data centers with geographic distribution

Mobile Security

Mobile App Security

Our mobile applications implement additional security measures:

Biometric Authentication: Face ID, Touch ID, and Android biometric unlock are processed entirely on-device by the operating system; PAMKIT never receives or stores biometric data

Biometric Authentication:

Secure Storage: Sensitive data stored in encrypted keychain/keystore
App Integrity: Code signing and integrity checks
Remote Wipe: Ability to remotely delete app data if device is lost

Vulnerability Disclosure Program

Responsible Disclosure

PAMKIT by Kollitech Corp. welcomes and encourages responsible security research. If you believe you have discovered a vulnerability in our platform, we ask that you disclose it responsibly so we can address it promptly.

How to Report

Please report security vulnerabilities by emailing security@pamkit.net. Include the following information in your report:

A detailed description of the vulnerability and its potential impact
Steps to reproduce the issue
Any proof-of-concept code, screenshots, or logs
Your contact information for follow-up

Our Response Timeline

Acknowledgment: We will acknowledge receipt of your report within 48 hours
Triage: We will assess the severity and validity of the report within 5 business days
Resolution: We will work to resolve confirmed vulnerabilities as quickly as possible, with critical issues prioritized for immediate remediation
Notification: We will notify you when the issue has been resolved

Safe Harbor

PAMKIT will not pursue legal action against individuals who conduct good-faith security research in compliance with this policy. Good-faith security research means:

You do not access, modify, or delete data belonging to other users
You do not disrupt or degrade the availability of our services
You do not exploit the vulnerability beyond what is necessary to demonstrate it
You report the vulnerability promptly and do not disclose it publicly until we have had a reasonable opportunity to address it

Scope of Testing

The following are in scope for security research:

The PAMKIT web application at pamkit.net
PAMKIT APIs and backend services
Authentication and authorization mechanisms

The following are out of scope:

Physical attacks against PAMKIT offices or infrastructure
Social engineering attacks against employees
Denial-of-service (DoS/DDoS) attacks
Third-party services and infrastructure not owned by PAMKIT

SOC 2 Type II & Security Audits

SOC 2 Type II Readiness

SOC 2 Type II readiness work is in progress; PAMKIT is not yet certified. Our infrastructure providers maintain their own SOC 2 Type II reports. When complete, our certification will validate our controls across the five Trust Services Criteria:

Security: Protection against unauthorized access
Availability: System uptime and operational reliability
Processing Integrity: Accurate and complete data processing

Processing Integrity:

Confidentiality: Protection of confidential information
Privacy: Proper collection, use, and disposal of personal information

Penetration Testing

We perform regular internal security testing, including penetration testing (most recently February 2026), and are engaging third-party testing as part of our SOC 2 readiness program. These assessments include:

External network penetration testing
Web application security testing (OWASP Top 10)
API security assessment
Social engineering testing
Remediation verification and re-testing

Continuous Monitoring

Beyond annual audits, we maintain continuous security monitoring:

Automated Vulnerability Scanning: Weekly automated scans of all production systems

Automated Vulnerability Scanning:

Dependency Auditing: Continuous monitoring of third-party dependencies for known vulnerabilities

Dependency Auditing:

Security Information and Event Management (SIEM): Real-time aggregation and analysis of security events

Security Information and Event Management (SIEM):

Compliance Monitoring: Ongoing assessment of compliance controls against SOC 2 criteria

Compliance Monitoring:

Business Continuity & Disaster Recovery

Recovery Objectives

Our business continuity plan is designed to minimize data loss and service disruption:

Recovery targets (internal, not contractual): we aim to limit data loss to the last daily backup and to restore service as quickly as practicable. These are planning objectives, not commitments.

Recovery targets (internal, not contractual):

Multi-Region Backup Strategy

We implement a comprehensive multi-region backup strategy to ensure data durability and availability:

Automated Daily Backups: Full database and file storage backups are performed daily

Automated Daily Backups:

Geographic Redundancy: Backups are replicated to geographically separate regions to protect against regional outages

Geographic Redundancy:

Encrypted Backups: All backups are encrypted at rest using AES-256 with separate encryption keys
Backup Verification: Automated integrity checks validate backup completeness and recoverability

Backup Verification:

Disaster Recovery Testing

Incident-response and recovery procedures are documented and exercised periodically. Lessons learned from any actual incidents are incorporated into the plan.

Service Continuity

Our infrastructure is designed for high availability:

Multi-region deployment with automatic failover
Load balancing across availability zones
Health monitoring with automated alerting
Runbook documentation for all critical recovery procedures

Employee Security

Personnel Security

Personnel with production access are bound by confidentiality obligations, receive security awareness training, and operate under least-privilege access that is reviewed periodically.

NDA Requirements: All employees and contractors are required to sign non-disclosure agreements (NDAs) before accessing any proprietary or customer data
Onboarding Training: All new employees complete security training during onboarding, with role-specific training for developers and operations staff

Onboarding Training:

Principle of Least Privilege

Access to systems and data is strictly limited:

Need-to-Know Basis: Employees are granted access only to systems and data required for their specific role
Quarterly Access Reviews: All access permissions are reviewed quarterly and adjusted as roles change

Quarterly Access Reviews:

Separation of Duties: Critical operations require approval from multiple authorized individuals

Separation of Duties:

Immediate Offboarding: Access is revoked immediately upon termination or role change, with automated de-provisioning workflows

Immediate Offboarding:

Acceptable Use Policy

All employees must adhere to our Acceptable Use Policy, which governs the use of company systems, data handling procedures, and reporting obligations for suspected security incidents.

Regulatory Compliance

PAMKIT complies with major data protection and privacy regulations:

GDPR: We honor data subject rights, maintain processing transparency and follow breach-notification requirements for users in the EEA and UK
CCPA (California Consumer Privacy Act): Compliance with California privacy laws, including consumer rights and data transparency

CCPA (California Consumer Privacy Act):

COPPA: The Service is not directed to children. COPPA applies to children under 13; our Terms additionally require all users to be 18 or older

Security Standards

We adhere to recognized security standards:

SOC 2 Type II: SOC 2 Type II readiness work is in progress; PAMKIT is not yet certified. Our infrastructure providers maintain their own SOC 2 Type II reports.
ISO 27001: Used as a reference control framework; PAMKIT is not ISO 27001 certified
NIST Framework: Alignment with NIST Cybersecurity Framework
OWASP Top 10: Protection against common web application vulnerabilities

Your Data, Your Rights

We believe in transparency and giving you control over your data

Your Rights

Access your personal data anytime

Correct or update your information

Delete your account and data

Export your data in standard formats

Object to processing of your data

Restrict processing of your data

Our Commitments

Never sell your personal data

Minimize data collection to what's necessary

Regular security updates and monitoring

Transparent privacy practices

Breach notification without undue delay, and within the deadlines applicable law imposes on us

Regular security audits and penetration testing as part of our SOC 2 program

Data Retention & Deletion

Data Retention Policy

We retain your data only for as long as necessary to provide the Service and comply with legal obligations. Retention periods vary by data category (account data, documents, financial records, backups, and more) and are maintained in one place: see the Data Retention section of our Privacy Policy for the full table. A legal hold or investigation can extend any of those periods.

Data Deletion

When you delete your account or request data deletion, personal data is deleted from our active systems and backups on the schedule described in the Data Retention section of our Privacy Policy.

Right to Erasure

Under GDPR and CCPA, you have the right to request deletion of your personal data. We will honor such requests unless we have a legal obligation to retain the data. To request data deletion, contact privacy@pamkit.net.

Security Incident Response

Security Monitoring

We rely on automated monitoring and alerting from our cloud providers, reviewed by engineering on an ongoing basis. This includes:

Network traffic and anomalies
Unauthorized access attempts
System vulnerabilities and patches
Data access patterns and anomalies
Third-party security alerts

Incident Response Procedures

In the event of a security incident, we follow a structured response plan:

Detection: Automated systems and security team identify potential incidents
Assessment: Security team evaluates the severity and scope of the incident
Containment: Immediate steps to prevent further damage or data exposure
Investigation: Detailed analysis to understand the cause and impact
Remediation: Fix vulnerabilities and restore normal operations
Notification: Inform affected users and authorities as required by law
Post-Incident Review: Analyze the incident and improve security measures

Post-Incident Review:

Breach Notification

In the event of a data breach that may affect your personal information:

Timely Notification: We will notify affected users without undue delay after confirming a breach, within the timeframes applicable law requires

Timely Notification:

Notification Methods: We will notify you via email and/or in-app notification

Notification Methods:

Information Provided: Notifications will include the nature of the breach, data affected, potential risks, and steps we're taking to address it

Information Provided:

Regulatory Reporting: We will report breaches to relevant data protection authorities as required by law

Regulatory Reporting:

Remediation Steps: We will provide guidance on steps you can take to protect yourself

Security Incident Categories

We categorize security incidents by severity:

Critical: Unauthorized access to user data, system compromise, or data breach
High: Potential data exposure, significant system vulnerabilities, or service disruption
Medium: Minor security issues, suspicious activity, or configuration errors
Low: Informational alerts, minor policy violations, or routine security events

Questions About Security?

Our security team is here to help. Contact us with any security-related questions or concerns.

security@pamkit.net Contact Support

PAMKIT by Kollitech Corp., 1160 Battery Street East, Suite #100, San Francisco, CA 94111