DigitalDoors, Inc. v. SouthPoint Bank

• Court: District Court, N.D. Alabama
• Decided: March 25, 2026
• Docket: 2:25-cv-00595
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ALABAMA SOUTHERN DIVISION

DIGITALDOORS, INC., ) ) Plaintiff, ) ) v. ) 2:25-cv-595-EGL ) SOUTHPOINT BANK, ) ) Defendant. )

MEMORANDUM OPINION & ORDER DigitalDoors sued SouthPoint Bank for allegedly infringing four patents covering methods to securely organize and store data. DigitalDoors does not know how SouthPoint protects data. All it seems to know about SouthPoint is that it is a bank. DigitalDoors believes that it is enough to state a claim. That is so, in its view, because a group of financial institutions (though not SouthPoint) spearheaded the creation of Sheltered Harbor, an initiative that promulgates data-security standards for the financial industry and certifies institutions who comply with the standards. According to DigitalDoors, at least some ways of complying with these standards (or their equivalent) infringe its patents, and banks certified by Sheltered Harbor hold around 70% of deposit accounts. DigitalDoors asserts that these allegations are enough to state a claim against SouthPoint. They are not. The complaint alleges nothing about SouthPoint that would indicate it uses Sheltered Harbor other than its line of business. But not all banks use

Sheltered Harbor. And the fact that a subset of the market might be infringing the patents does not justify blindly suing every bank. The complaint is DISMISSED, though DigitalDoors may file an amended complaint within 14 days.

BACKGROUND1 DigitalDoors is a data security company. Doc. 1 ¶2. In 2007, it became “the sole and exclusive owner” of the four patents asserted in this case. Id. at ¶¶19-20.2 Each patent relates “generally to … organizing and processing data” by extracting

“specific sensitive content for specialized storage and subsequent reconstruction.” Id. at ¶27. These patented methods extract content from both structured and unstructured data, apply various filters, classify the content, map and select the

appropriate storage architecture, and set a protocol for data reconstruction. Id. at ¶28.

1 The Court accepts well-pleaded factual allegations as true and construes those allegations in the light most favorable to the plaintiff. Lanfear v. Home Depot, Inc., 679 F.3d 1267, 1275 (11th Cir. 2012). 2 The four patents are U.S. 9,015,301; U.S. 9,734,169; U.S. 10,182,073; and U.S. 10,250,639. DigitalDoors has sued roughly 60 banks for infringing those patents. See DigitalDoors, Inc. v. Peapack Priv. Bank & Tr., No. CV 25-2349, 2025 WL 1592715, at *1 (D.N.J. June 5, 2025) (“The allegations against Peapack are identical to those brought by DigitalDoors against fifty-nine other financial services institutions across the country.”). DigitalDoors believes that its patents are infringed by most financial institutions that comply with the Sheltered Harbor standard or its functional

equivalent. See, e.g., id. at ¶96. Sheltered Harbor is an “industry-driven initiative launched in 2015 to promote the stability of the U.S. financial markets by protecting critical account information and data sets of market participants in order to facilitate

the recovery and use of such information following a destructive cyberattack or other extreme loss of operational capability.” Id. at ¶63. Sheltered Harbor furthers its mission by creating data-protection standards and certifying complaint systems. Id. at ¶¶63, 65.

Founded by thirty-four financial institutions and owned by FS-ISAC Inc. (a worldwide non-profit with board members from organizations like Citigroup, Bank of American, Morgan Stanley, Truist, and Deutsche Bank), Sheltered Harbor

“provides the only industry-developed standards and certifications for resilience, data recovery, and protection of isolated data.” Id. at ¶64. With financial institutions having legal and market incentives to protect customer data, 72% of deposit accounts and 71% of retail brokerage client assets are held by Sheltered Harbor-certified

banks. Id. at ¶66. DigitalDoors also alleges that “Sheltered Harbor certification, or its functional equivalent, is required by industry regulations.” Id. at ¶95. But the complaint does

not cite the referenced industry regulations. Instead, it supports the allegation with a couple of quotations from exhibits: that “[i]ndustry regulation requires that financial institutions prepare for a data destruction event” and that, according to the American

Bankers Association, “100% participation [in Sheltered Harbor] is optimal.” Id. DigitalDoors sued SouthPoint Bank for using data security systems that infringe its patents. See id. at ¶¶95-96. DigitalDoors alleges, on information and belief, that SouthPoint is a “consumer and business financial institution” that “acts

responsibly with respect to cybersecurity” and “endeavors to provide robust state of the art data security protection to customer financial information.” Id. at ¶¶5-7. DigitalDoors does not know the specifics of SouthPoint’s data security efforts

because those measures are “uniquely known to SouthPoint and are beyond public view.” Id. at ¶96. DigitalDoors nonetheless alleges based on information and belief that SouthPoint uses systems or methods that either comply with the Sheltered Harbor standard or are functionally equivalent. Id. Though Southpoint would not

“necessarily infringe” if it implemented such systems, according to DigitalDoors, it “likely” would. Doc. 25 at 12. DigitalDoors asserts five counts of patent infringement against SouthPoint, one for each patent and then an additional claim for willful infringement. Each claim

rests on the assumption that SouthPoint implements Sheltered Harbor or a functional equivalent. SouthPoint moved to dismiss under Federal Rule of Civil Procedure 12(b)(6). Doc. 22. The Court held a hearing on the motion, during which

DigitalDoors abandoned (at least for now) its willful infringement claim. DISCUSSION Under Federal Rule of Civil Procedure 8(a)(2), a complaint must include “a short and plain statement of the claim showing that the pleader is entitled to relief.”

This requires a plaintiff to plead “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). The test is

not whether the defendant is probably liable, but the allegations must indicate “more than a sheer possibility that a defendant has acted unlawfully.” Id. DigitalDoors alleges SouthPoint is violating 35 U.S.C. § 271(a) because it “makes, owns, operates, uses, or otherwise exercises control over” systems and

methods that infringe its patents. Doc. 1 at ¶96. To state a claim, DigitalDoors must first identify the allegedly infringing products. See K-Tech Telecomms., Inc. v. Time Warner Cable, Inc., 714 F.3d 1277, 1284 (Fed. Cir. 2013); Golden v. Qualcomm

Inc., No. 2023-1818, 2023 WL 6561044, at *2 (Fed. Cir. Oct. 10, 2023). The infringing product, according to DigitalDoors, is a Sheltered Harbor system or its functional equivalent. Doc. 1 at ¶96.

SouthPoint moves to dismiss because DigitalDoors has not adequately alleged that SouthPoint uses Sheltered Harbor or an equivalent. Doc. 23 at 13-19. SouthPoint also asserts that the Court should dismiss the complaint because implementing

Sheltered Harbor does not necessarily infringe the patents and because the patents are invalid. Id. at 20-33. But the Court need not reach those arguments because it agrees that DigitalDoors has not plausibly alleged that SouthPoint uses Sheltered Harbor or an equivalent.

A. At this stage, plaintiffs often know the product the alleged infringer uses and the dispute is whether the product likely infringes. See, e.g., Bot M8 LLC v. Sony Corp. of Am., 4 F.4th 1342, 1354-55 (Fed. Cir. 2021). But not here. DigitalDoors’s

allegations about the product SouthPoint uses are based on information and belief. Doc. 1 at ¶¶5, 7, 96. It does not know the product SouthPoint uses, it says, because that information is kept confidential to enhance effectiveness. See id. at ¶96; Doc. 25 at 12-13.

Plaintiffs are entitled to make allegations based on information and belief. See 5 WRIGHT & MILLER, FEDERAL PRACTICE AND PROCEDURE § 1224 (4th ed.); cf. FED. R. CIV. P. 11(b) (requiring attorneys to certify that filings are supported by

“knowledge, information, and belief, formed after an inquiry reasonable under the circumstances”). But those allegations, like any other, are not assumed to be true if lacking “enough facts” to make them “plausible.” Mann v. Palmer, 713 F.3d 1306,

1315 (11th Cir. 2013); see Brown v. Anderson, No. 21-10494, 2023 WL 1102568, at *3 (11th Cir. Jan. 30, 2023) (courts “don’t have to take as true allegations made upon information and belief that lack the factual support to be plausible”).3

That is the case here. DigitalDoors’s allegation, based on information and belief, that SouthPoint infringes its patents because it uses a Sheltered Harbor- compliant system or its functional equivalent (see Doc. 1 at ¶96) is too speculative, as it is based on general allegations about the financial industry, not anything that

SouthPoint has done. DigitalDoors claims SouthPoint uses Sheltered Harbor or an equivalent because there are market and legal incentives for SouthPoint to do so, see, e.g., Doc.

1 at ¶¶6-9, 95, and because there is “near uniform” participation in Sheltered Harbor, the industry standard, id. at ¶¶66, 95. But there is no plausible allegation that banks are required to implement Sheltered Harbor or an equivalent.4

3 See Bascom Glob. Internet Servs., Inc. v. AT&T Mobility LLC, 827 F.3d 1341, 1347 (Fed. Cir. 2016) (“We review a district court’s dismissal for failure to state a claim under the law of the regional circuit.”). 4 See Crenshaw v. Lister, 556 F.3d 1283, 1292 (11th Cir. 2009) (exhibits trump contradicting conclusory allegations); compare Doc. 1 at ¶95 (“Sheltered Harbor certification, or its functional equivalent, is required by industry regulations.”) (citing Docs. 1-19 & 1-32), with Doc. 1 at ¶95 (“Industry regulation requires that financial institutions prepare for a data destruction event.”) (quoting Doc. 1-19), and Doc. 1 at ¶95 (“100% participation is optimal.”) (quoting Doc. 1-32). Thus, DigitalDoors’s “information and belief” reduces to Sheltered Harbor’s popularity in the financial industry. Even with that allegation, however, the

“complaint merely asserts, without any supporting factual basis, that [SouthPoint] uses a Sheltered Harbor-compliant system.” DigitalDoors, Inc. v. EagleBank, No. 24-CV-03792, 2026 WL 554533, at *6 (D. Md. Feb. 27, 2026). That is because there

is not uniform participation in Sheltered Harbor. DigitalDoors alleges that participation is “near uniform,” Doc. 1 at ¶66, but it never provides the percentage of banks that implement Sheltered Harbor. DigitalDoors clarifies that when it claims uniform participation, it is referring not to

the percentage of banks using it, but to the percentage of accounts held by banks that do so. The allegation—that 72% of deposit accounts and 71% of retail brokerage client assets are held by participants—might prove more helpful if it equated to

roughly 70% of banks using Sheltered Harbor, id., but nothing in the complaint supports that assumption.5 The complaint instead undermines that inference, as DigitalDoors also alleges that 34 financial institutions founded Sheltered Harbor and that representatives from some of the nation’s largest banks sit on the owner’s board.

Id. at ¶64. Nor does DigitalDoors allege anything unique about SouthPoint making it plausible that it is among the participants. For example, there is no allegation that

5 Nonetheless, it isn’t even clear that such an assumption would suffice to state a claim. SouthPoint was one of the 34 founding institutions, that any of its representatives sit on the board of the entity that owns Sheltered Harbor, that any of its officers or

employees supported Sheltered Harbor, or that it has ever associated with Sheltered Harbor in any way whatsoever. There aren’t even any allegations about SouthPoint’s size, market share, services, or anything of the like to support the inference that it

likely uses Sheltered Harbor. Indeed, across its 100-page complaint, DigitalDoors alleges almost no specific facts about SouthPoint aside from the fact that it is a bank in Alabama. But SouthPoint opening its doors as a bank is not enough for DigitalDoors to

state a claim against it. That is because SouthPoint being a bank is “merely consistent” with liability, which alone does not state a claim. Iqbal, 556 U.S. at 678. Not all banks use Sheltered Harbor, and there are no well-pleaded facts in the

complaint, assumed true, that could not also be said about a bank that does not use Sheltered Harbor. Thus, there is “an obvious alternative explanation” for the well- plead allegations against SouthPoint, and DigitalDoors cannot “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555, 567. “Given what little the

complaint tells us [about SouthPoint], there is nothing reasonable about [the] expectation that taking discovery would reveal any infringement.” DigitalDoors, Inc. v. Peapack Priv. Bank & Tr., No. CV 25-2349, 2025 WL 1592715, at *2 (D.N.J.

June 5, 2025). B. DigitalDoors contends that it should be allowed to move forward based on speculation because there is no way for it to know without discovery who is

infringing and who is not. See Doc. 25 at 12-13. While DigitalDoors cites decisions sympathetic to plaintiffs when facts are “peculiarly within … possession and control” of a defendant, id., even those decisions do not grant unlimited license. In

one such case, the court explained that the plaintiff “must offer sufficient factual allegations to show that he or she is not merely engaged in a fishing expedition,” Innova Hosp. San Antonio, Ltd. P’ship v. Blue Cross & Blue Shield of Georgia, Inc., 892 F.3d 719, 730 (5th Cir. 2018), and in another the court explained that the plaintiff

must plead “plausible reasons for its ‘belief,’” Exergen Corp. v. Wal-Mart Stores, Inc., 575 F.3d 1312, 1330-31 (Fed. Cir. 2009). DigitalDoors failed to do either. The Eleventh Circuit’s approach is similarly unhelpful for DigitalDoors. In

Mann, a prisoner sentenced to death challenged Florida’s lethal injection protocol under the Eighth Amendment. 713 F.3d at 1306. Under the Eighth Amendment, he needed to allege that the State’s method likely would inflict severe pain. Id. at 1314-15. To that end, he claimed the State lacked “a safe, current, or adequate

supply” of a lethal injection drug. Id. at 1315. He supported his showing by alleging on information and belief that because the manufacturer refused to sell it to States for use in capital punishment, Florida’s supply must have been “either expired,

illegally obtained, or compounded.” Id. at 1309, 1315. No doubt an inmate would have a hard time knowing for certain, without discovery, whether the State’s drugs expired, how the drugs were obtained, or how the drugs were compounded. Those

are not widely publicized details. And the manufacturer cutting off access certainly lent some credibility to his allegations. Yet the Eleventh Circuit declined to accept as true that “conclusory allegation ‘upon information and belief’” because it was not

adequately supported by other facts. Id. at 1315. Under this standard, DigitalDoors fails to state a claim. To be sure, the Eastern District of Texas and the Northern District of Georgia have found that DigitalDoors stated a claim against other banks based on similarly

scanty allegations, but the Court respectfully disagrees. The Northern District of Georgia did so by crediting DigitalDoors’s allegation that industry regulations require Sheltered Harbor or an equivalent. See, e.g., Doc. 25-6 at 15. But this Court

declined to credit that conclusory allegation because it is contradicted by the supporting exhibits. See supra, at 7 n.4. Without that allegation, DigitalDoors is left to speculate that SouthPoint is one of the banks using Sheltered Harbor even though it concedes that not all of them do.

And the Eastern District of Texas never grappled with the non-uniformity of the allegedly infringing technologies and the resulting obvious alternative explanation for the defendant’s conduct. See Doc. 25-2 at 5-7. But that is the required

analysis and the reason DigitalDoors fails to state a claim. At bottom, DigitalDoors’s arguments are based on an incorrect view of the law. As it sees things, even if it alleged that only 1% of banks in the United States

are infringing its patents, it could state a claim against every bank in the United States because it is difficult to sort the infringers from the innocent. That is wrong. Cf. Peapack, 2025 WL 1592715, at *2 (rejecting DigitalDoors’s “infringement-by-

assumption logic”); cf. FDA. v. All. for Hippo. Med., 602 U.S. 367, 396 (2024) (“The ‘assumption’ that if these plaintiffs lack ‘standing to sue, no one would have standing, is not a reason to find standing.’”). DigitalDoors cannot “unlock the doors of discovery” and impose significant costs against every player in an entire industry

because of the “sheer possibility” it might prevail in at least some of those cases. Iqbal, 556 U.S. at 678. To the contrary, DigitalDoors must “show[]” that it is “entitled to relief” from the defendant, id. at 679, not some unknown members of

the market. It has not done so against SouthPoint. CONCLUSION The Motion to Dismiss (Doc. 22) is GRANTED. The complaint is DISMISSED, but the Court GRANTS DigitalDoors leave to file an amended complaint on or before April 8, 2026. DONE and ORDERED this 25th day of March, 2026.

EDMUND G. LACOUR JR. UNITED STATES DISTRICT JUDGE