Log in

Compliance: Data Security (GLBA)

Collections data, protected to financial-institution standards.

Collectors hold some of the most sensitive data there is: Social Security numbers, account numbers, payment credentials, and medical information. The FTC Safeguards Rule, state laws, and PCI DSS set the requirements. HL Hunt meets them with SOC 2 Type II audited controls, encryption everywhere, and least-privilege access.

Start freeLog in to your dashboard
  • Free plan, no credit card
  • FDCPA, TCPA & Reg F enforced
  • Outreach live in under an hour
  • Commission only on recoveries
SOC 2
Type II audited annually
PCI DSS
Level 1 for payment data
AES-256
Encryption at rest; TLS 1.2+ in transit
GLBA
Safeguards Rule program documented

How HL Hunt enforces Data Security (GLBA)

  • Safeguards Rule program

    Written information security program, designated qualified individual, risk assessments, and annual reporting support for your own obligations.

  • Encryption everywhere

    Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Sensitive fields encrypted at the field level.

  • Access controls

    Role-based least-privilege access, SSO and MFA, session management, and complete access logging.

  • PCI DSS payment handling

    Card data captured through tokenized, PCI-compliant flows and never stored on the platform in raw form.

  • Data minimization and retention

    Collect only what is needed, retain per configurable policy, and dispose securely, as the Safeguards Rule requires.

  • Incident response

    Documented response plan, breach notification support within required timelines, and vendor risk management.

Stop worrying about Data Security (GLBA). Let the engine enforce it.

Create a free account, upload your first accounts, and compliant AI outreach starts within the hour. No credit card, no contract.

Start freeLog in

How it works

  1. 01

    Controls audited

    SOC 2 Type II and PCI DSS assessments conducted annually by independent auditors.

  2. 02

    Data protected

    Encryption, access control, monitoring, and retention policies enforced on every record.

  3. 03

    Documentation provided

    Reports, DPAs, BAAs, and vendor due diligence packages available for your compliance program.

What the Safeguards Rule requires of collectors

The Gramm-Leach-Bliley Act requires financial institutions to protect customer information, and the FTC's Safeguards Rule, significantly strengthened in 2023, spells out how. Debt collectors are financial institutions under the rule. It requires a written information security program with a designated qualified individual, periodic risk assessments, specific safeguards including encryption of customer information at rest and in transit, multi-factor authentication for anyone accessing customer information, secure development practices, data retention and disposal policies, change management, continuous monitoring or annual penetration testing, and a written incident response plan. Since 2024, covered entities must notify the FTC of breaches affecting 500 or more consumers within 30 days.

State laws add requirements, from New York's DFS cybersecurity regulation to state breach notification laws with varying timelines. PCI DSS applies to anyone handling card payments. Healthcare collectors operating as business associates have HIPAA security rule obligations. And service providers to collectors must be overseen under the Safeguards Rule, which means your platform vendor's security is your compliance problem.

HL Hunt is built to be the strongest part of your security program. Controls are audited annually under SOC 2 Type II, covering security, availability, and confidentiality. Payment flows are PCI DSS Level 1. Data is encrypted at rest and in transit with field-level encryption for the most sensitive elements. Access is role-based with SSO and MFA, and every access is logged. Retention policies are configurable and enforced. Incident response is documented and tested. Audit reports, a Data Processing Agreement, a Business Associate Agreement for healthcare, and vendor due diligence packages are available to satisfy your own oversight obligations.

What changes

HL Hunt vs the traditional approach

Start free
 HL HuntTraditional collections
Data Security (GLBA)Encoded as rules that run before every action and log every decisionCovered in annual training; violations found in audits or lawsuits
Who does the workAI contacts, converses, negotiates, and collects; humans handle exceptionsAgents on a dialer working whatever fits in the day
ComplianceEvery contact checked against FDCPA, TCPA, Reg F, and state law before it happensTraining, scripts, and audits after the fact
ChannelsSMS, email, AI voice, letters, and a self-service portal chosen per debtorPhone calls and letters on a fixed schedule
CoverageEvery account worked, including small balancesLarge balances worked; the rest ages out
VisibilityEvery message, transcript, promise, and payment live in your dashboardA monthly PDF report
CostFree to $649 a month plus 3% to 26% commission; Enterprise custom25% to 50% contingency, or seats plus modules plus services

Pricing

Start free. Pay only on what you recover.

Data Security (GLBA) is included on every plan. Start at $0 a month with 50 active collections, and move up as your portfolio grows. Commission falls from 26% on Free to 3% on Enterprise, and it is charged only on money actually recovered.

Enterprise: unlimited collections, seats, SMS, voice, and email with a 3% commission, SOC 2 reports, DPA, and dedicated support.

Start freeFull pricing
$0
Free

50 active collections · 26% commission · 1 seat

$149
Basic, per month

250 active collections · 15% commission · 3 seats

$349
Growth, per month

1,000 active collections · 10% commission · 10 seats

$649
Scale, per month

5,000 active collections · 6.5% commission · 25 seats

Everything included

One platform covers all of it

Data Security (GLBA) is one part of the platform. Every HL Hunt plan, from Free to Enterprise, includes the full collections stack, so you never bolt on a second vendor as your portfolio grows.

Start freeSee pricing

Get started

Go live with Data Security (GLBA) today

Create a free account, upload your first accounts, and AI outreach begins within the hour. No credit card, no contract, no implementation project. Here is what to have ready.

Start freeLog in

Prefer to talk first? info@hlhunt.org

  1. 01A CSV or system export of delinquent accounts: name, contact details, balance, and itemization
  2. 02Consent and contact-preference data you hold for phone numbers and email addresses
  3. 03Your legal entity, any collection licenses you hold, and the states you collect in
  4. 04Your existing policies, scripts, and templates so we can map them into the rule engine
  5. 05Your compliance officer or counsel for a short configuration review before go-live

Data Security (GLBA) FAQ

Are debt collectors covered by the FTC Safeguards Rule?

Yes. Debt collectors are financial institutions under GLBA and must comply with the Safeguards Rule, including the written program, qualified individual, encryption, MFA, and incident response requirements.

Is HL Hunt SOC 2 certified?

HL Hunt undergoes annual SOC 2 Type II audits covering security, availability, and confidentiality. Reports are available to Enterprise clients under NDA.

How is payment card data handled?

Through PCI DSS Level 1 tokenized flows. Raw card data never touches HL Hunt systems in storable form, including during AI voice payment capture.

Where is data hosted?

In SOC 2 and ISO 27001 certified US data centers, with data residency options for Enterprise clients.

Still have questions?

Talk to a collections specialist, or start free and see the platform for yourself.

Email usStart free

Explore more

Start recovering more today.

Create a free account, upload your first accounts, and compliant AI outreach begins within the hour. Pay commission only on what you recover.

Start freeLog in
Start free