Security at pinpole

PinPole is a young company with a serious security posture. We have not yet accumulated the observation period required for SOC 2 Type II — that is a function of time, not intent or practice. What we have done is build the controls, processes, and evidence collection infrastructure from day one so that our audit record is clean when the Type I observation window closes.

Here is an honest summary of where we stand:

PinPole's entire production infrastructure runs on Amazon Web Services (AWS) in the Asia Pacific (Sydney) — ap-southeast-2 region. There are no co-located servers, no third-party data centres, and no infrastructure outside of AWS managed services.

What data PinPole holds

PinPole holds three categories of customer data:

• Account and identity data: Name, email, organisation, billing information, subscription status.
• Architecture and canvas data: Canvas definitions, service configurations, connection topology, workload profiles, simulation parameters — the intellectual content of your infrastructure designs.
• Simulation and deployment records: Simulation run results, cost estimates, recommendation outputs, execution history, and deployment event logs.

What PinPole does not do with your data

• PinPole does not sell, rent, or trade customer data to any third party.
• PinPole does not use your architecture designs or simulation outputs as training data for AI or machine learning models without your explicit written consent.
• PinPole does not share your architecture data with other customers under any circumstances.
• PinPole support personnel do not have standing access to canvas content or simulation outputs. Any access for support purposes requires your explicit in-session permission.

Retention and deletion

• Canvas and simulation data: Retained for the duration of your active subscription. Deleted within 30 days of account closure.
• Account data: Retained for 90 days after account closure, then securely deleted.
• Billing records: Retained for 7 years to satisfy Australian taxation obligations.
• Audit and access logs: Retained for 12 months, then purged.

Internal access

Access to production systems and customer data within PinPole is governed by the following controls:

• Least privilege: All internal roles are scoped to the minimum access required. Production database access is restricted to a small set of senior engineers.
• MFA required: Multi-factor authentication is mandatory for all employees accessing production environments, identity systems, and cloud management consoles.
• Access review: Internal access rights are reviewed quarterly. Access is revoked immediately upon role change or termination.
• No standing production access: Engineers do not hold persistent access to production data stores. Just-in-time (JIT) access is required for any direct data access and is logged to the audit trail.
• Password policy: All internal accounts follow NIST 800-63B password guidelines. Passwords for critical systems are managed through a secrets manager.

Customer-facing RBAC

Enterprise plan customers can configure role-based access control (RBAC) within PinPole to govern which users can perform design, simulation, deployment, and administrative actions:

• Viewer: Read access to canvases and simulation results only. Cannot initiate simulations or deployments.
• Editor: Full canvas design and simulation rights. Cannot initiate AWS deployments.
• Deployer: Editor rights plus the ability to initiate deployment to connected AWS accounts.
• Admin: Full platform rights including user management, AWS account connections, and billing.

PinPole's deployment feature gives it access to customer AWS accounts. This is the highest-sensitivity capability in the platform and is governed by the following security architecture.

PinPole operates a structured vulnerability management program covering the full stack:

• Dependency scanning: Automated scanning of all application dependencies on every code commit and nightly. Critical vulnerabilities block deployment to production.
• Static application security testing (SAST): Static analysis is applied to the application codebase as part of the CI/CD pipeline.
• Infrastructure vulnerability assessment: Periodic automated scanning of production infrastructure configuration against CIS benchmark controls.
• Annual penetration testing: PinPole engages an independent third-party security firm to conduct annual penetration testing of the production environment, including the AWS deployment pipeline and authentication surfaces.
• Remediation SLAs: Critical vulnerabilities are remediated within 72 hours. High-severity vulnerabilities within 7 days. Medium within 30 days.

Responsible disclosure

If you have discovered a potential security vulnerability in PinPole, please report it to security@pinpole.cloud. We aim to acknowledge reports within 24 hours and will communicate progress on a fix within 7 business days. We do not pursue legal action against researchers who act in good faith.

PinPole maintains a documented Security Incident Response Plan covering detection, containment, eradication, and recovery. Key commitments:

• 24-hour detection target: PinPole's monitoring infrastructure is designed to detect anomalous access and potential breaches within 24 hours of occurrence.
• Customer notification: In the event of a confirmed security incident affecting Customer Data, PinPole will notify affected customers as quickly as practicable and in accordance with obligations under the Privacy Act 1988 (Cth) Notifiable Data Breaches (NDB) scheme — within 30 days of becoming aware that an eligible data breach has occurred.
• Breach notification content: PinPole will provide customers with a description of the breach, the data affected, the remediation steps taken, and recommendations for any actions customers should take.
• Post-incident review: A root cause analysis and lessons-learned review is conducted after every significant security incident, with findings shared with affected customers on request.

PinPole's compliance programme is aligned with its product and commercial roadmap. The following milestones are committed targets, not aspirations:

If your organisation requires a security review before approving PinPole as a vendor, here is what we can provide and how to request it.

Available documentation

• Security controls summary: A written overview of PinPole's security architecture, controls, and data handling practices — suitable for inclusion in a vendor risk register.
• SOC 2 audit scope letter: A letter from our auditor confirming that a SOC 2 Type I engagement is in progress, including the scope of systems under audit and the expected report date.
• Pre-audit evidence package: Our internal control documentation — policies, access control matrices, encryption configuration evidence, and incident response plan — for customers who cannot wait for the Type I report.
• AWS architecture overview: A description of PinPole's production infrastructure architecture, including network topology, data flow diagrams, and service boundaries.
• Vendor security questionnaire (VSQ) responses: We will complete standard security questionnaires (SIG Lite, CAIQ, or your organisation's proprietary format) within 5 business days.
• Sub-processor list: A current list of all third-party service providers with access to customer data, including their data processing role and certification status.
• Data Processing Addendum (DPA): Available on request for customers with specific data processing agreement requirements.

Bridging the certification gap

We understand that for some organisations, a completed SOC 2 Type I report is a hard procurement requirement. If that is your situation, here are three paths forward:

• Wait for July 2026: Our Type I report is on track for July 2026. If your evaluation timeline permits, we can hold a slot and provide the report as soon as it is issued.
• Pre-audit evidence review: Many security teams can approve a vendor with an in-progress audit and a documented control set. We can walk your security team through our controls in a live review session.
• Conditional approval: Some organisations approve vendors conditionally on receipt of the Type I report within a specified period. We are happy to commit to this in writing.

For security reviews, vendor questionnaires, vulnerability reports, or any other security enquiry:

We aim to respond to all security enquiries within 1 business day and to deliver requested documentation within 5 business days.