Security and data handling

What happens to your information, stage by stage

This page describes what Pewter does today. We list only practices we actually follow. Where a protection depends on a specific deal, we say so, and your agreement is where it gets written down.

The stages of a deal

Who sees what, and when

1. Your first inquiry: We collect your name, contact details and basic facts about your firm: size, years in business, industry, the systems you use. We never ask for business records through this website, and you shouldn't send any. With your consent, we share your firm's name, size and industry with our licensing partner so it can prepare an estimate.
2. Sizing your records: You fill in a data inventory: which systems you use, roughly how much is in each and how many years they cover. It holds no record contents. We use an AI model to check the inventory for gaps, and it sees only those system names and sizes.
3. A quality sample, if you agree: Before an offer, we may ask for a small sample of records to check their quality. You choose what goes in it, and you can say no. Pewter or our licensing partner may review the sample as you provide it, before de-identification. Before you share it, ask us how it will be transferred, who will see it and when it will be deleted, and we will answer in writing.
4. Your written offer: The offer sets out price, scope, permitted use, exclusivity and payment milestones. You and your counsel review it. Nothing beyond an agreed sample is exported until you sign.
5. De-identification: Names, contact details, account numbers, credentials and payment details are removed or replaced with consistent placeholders before delivery. You review a de-identified sample before release, and you can exclude regulated, privileged or third-party records. No method removes every risk, which is why you see the output first.
6. Delivery and payment: The de-identified copy goes to the recipient and for the uses named in your agreement. Payment follows the milestones in that agreement. Your originals stay with you and remain yours.

What we don't claim

Protections that depend on the deal

Pewter holds no security certification of its own, such as SOC 2, and we won't imply that a provider's certification is ours. Larger transactions can involve further protections, such as escrow, an independent review of the de-identified data, or specific insurance. Where they apply, they are negotiated and written into your agreement. We don't advertise them as standard.

Payment safety

Pewter will never send or change payment instructions by email. If you receive new wire details from anyone in a deal, call us on a number you already know before you act.

This website

How the site protects you

Encryption in transit: The site is served only over HTTPS, and browsers are told never to connect without it (HSTS).
Browser protections: A content security policy limits which outside services pages can load, and pages can't be embedded in other sites.
Partner sign-in: Referral partners sign in with a one-time link sent to their email, not a password. Each partner sees only the introductions they made; the server enforces that.
Service providers: The providers that handle your contact details are listed in our privacy policy, each used only for its purpose.
Visit statistics: Cookie-free statistics that don't identify you.

Diligence and reports

Questions from your counsel or IT team

Send your security questionnaire or questions to lawrence@pewterdata.com and we will answer in writing. To report a security problem with this site, email lawrence@pewterdata.com or troy@pewterdata.com; our security.txt has the details.