Pi Credits Security & Compliance Whitepaper

Pi Credits is a cloud platform that lets a law firm or litigation funder pre-fund a credit wallet, dispense prescriptions to injured clients through a licensed U.S. pharmacy, and reconcile that spend against the case lien at settlement. The controls described here apply to the production platform at app.picredits.com and the data it processes on behalf of subscribing firms.

• Minimum-necessary access: every role is scoped to the smallest slice of information it needs to do its job, never the most convenient default.
• Firm-controlled membership: each firm admin decides who has access and can revoke it the moment someone leaves.
• Confidentiality procedures govern how client, patient, and business information is handled.
• Data retention is aligned to settlement, contractual, and legal obligations — kept long enough to defend a lien, not longer than required.

• Encryption in transit (TLS) on every connection and encryption at rest for stored records.
• Role-based access control enforced on every account and every request.
• Continuous monitoring so anomalies are caught while they are still small.
• Audit logging of logins, edits, and financial movements as they happen.

Every firm operates in its own sealed environment. One firm’s cases, clients, balances, and records are invisible to every other company on the platform, and that isolation is enforced at the database level — not only by application logic. Inside a firm, case teams see only their own firm’s cases, and each person sees only what their role requires.

All connections to the platform run over TLS, and stored records are encrypted at rest. An intercepted connection or a compromised disk never yields a readable case file. Card data is never encrypted-and-stored by Pi Credits because it never touches Pi Credits systems (see Payment Security).

Protected health information is visible only to the people coordinating care on a case — attorneys, case managers, and the pharmacy. Billing staff, analysts, and referral partners work with case and financial views that contain no health information at all, and PHI is kept out of every email and notification the platform sends. Multi-factor authentication is available on every account; Enterprise plans add single sign-on with the firm’s identity provider.

Every credit purchase and every prescription is written to a permanent, time-stamped record the moment it happens. Nothing can be edited or deleted after the fact — corrections are appended as new entries, so the history stays complete. Every login, edit, and dollar moved is logged as it happens, so “who touched this record and when” is already answered rather than reconstructed. At settlement, a firm exports the ledger and hands the adjuster a record they can verify line by line but cannot dispute.

All card payments run through Elavon Converge Hosted Payments. Card details are entered directly with the processor and never pass through or get stored on Pi Credits servers, keeping payment data inside a certified, PCI-compliant environment.

Pi Credits maintains procedures to identify, investigate, respond to, and recover from security events, backed by backup and recovery processes built for business continuity. The response begins immediately because the plan is already in place rather than written after the fact.

• Business Associate Agreements (BAA) are executed as part of Enterprise onboarding where a firm’s use of the platform makes Pi Credits a business associate under HIPAA.
• Confidentiality standards your legal team can review govern client, patient, and business data.
• Full audit exports and API access are available for firms with their own compliance and reporting requirements.