This page describes the technical and organisational controls in place for the Pillar2OS platform. We publish factual controls rather than generic assurances. Where a control is not yet in place, we say so.
| Control | Detail | Status |
|---|---|---|
| Cloud provider | Railway — managed cloud platform running on AWS infrastructure. | Confirmed |
| Data region | US-East (Railway default). EU region deployment available on request for customers with data residency requirements. Confirm your region with us before signing. | On request |
| Database | PostgreSQL managed by Railway. Database credentials are environment-injected and never committed to version control. | Confirmed |
| Encryption at rest | Railway managed PostgreSQL uses AES-256 disk encryption at the storage layer (AWS EBS). Backups are encrypted with the same key. | Confirmed |
| Encryption in transit | All connections to app.pillar2os.com enforce HTTPS/TLS 1.2+. HTTP is not accepted. API responses include Strict-Transport-Security headers via Railway's edge proxy. |
Confirmed |
| Backups | Railway performs automated daily backups of the managed PostgreSQL instance. Point-in-time recovery is available. Backup retention: 7 days. | Confirmed |
| Control | Detail | Status |
|---|---|---|
| Authentication methods | Email/password and magic link (passwordless). Both are available to all users. | Live |
| Two-factor authentication | TOTP-based 2FA (authenticator app). Available to all users; can be made mandatory per organisation on request. | Live |
| Password hashing | bcrypt with 10 cost rounds. Passwords are never stored in plaintext. Hash parameters are upgraded transparently on next login. | Confirmed |
| Session tokens | JWT (HS256), 24-hour expiry, issued as HttpOnly cookies. Magic link tokens expire after 15 minutes and are single-use. | Confirmed |
| SSO / SAML | Not currently available. Roadmap item for enterprise customers. Contact us to discuss requirements. | Roadmap |
| Role-based access | Platform roles: Admin and Member. Collaboration Centre adds granular roles: Coordinator, Contributor, Advisor — each scoped to specific entities. | Live |
| Email verification | All new accounts require email verification before access is granted. Unverified accounts cannot access any data. | Confirmed |
| CORS policy | Strict allowlist — the API accepts requests only from pillar2os.com and app.pillar2os.com. All other origins are rejected. |
Confirmed |
| Control | Detail | Status |
|---|---|---|
| Data model isolation | Every data record — projects, entities, calculation runs, documents, queries, team members — carries an indexed org_id foreign key. Cross-organisation queries are structurally impossible. |
Confirmed |
| API-layer enforcement | Every API endpoint extracts org_id from the authenticated JWT and filters all database queries by it. No endpoint accepts a client-supplied org_id parameter. |
Confirmed |
| Shared database | Tenants share a PostgreSQL instance with logical isolation enforced at the application layer. Physical database isolation (dedicated instance per tenant) is not currently offered. | Logical only |
| Admin access | Platform admin access is restricted to a single named account. Admin operations require a separate ADMIN_SECRET header; the admin panel is not accessible from the public app. |
Confirmed |
| Control | Detail | Status |
|---|---|---|
| Calculation audit trail | Every GloBE calculation produces an append-only AuditEvent record — timestamped, user-attributed, and linked to the source input row. Records are never updated or deleted. |
Confirmed |
| Immutable source data | Uploaded data rows are append-only. Corrections are written as new versioned rows, not overwrites. The original submission is always preserved and accessible. | Confirmed |
| Provenance traces | Every GIR output figure is linked to its derivation chain — input row → rule applied (with OECD article citation) → computed value. Traces are exportable. | Confirmed |
| Application logging | Server-side request logs retained by Railway. Structured error logging to Railway's log service. Log retention: 30 days. | Confirmed |
| Control | Detail | Status |
|---|---|---|
| Customer data retention | Customer data is retained for the duration of the subscription and for 90 days following cancellation. After 90 days, data is deleted from production systems. | Policy set |
| Data deletion on request | Account and organisation data deletion is available on request at any time. Email sales@pillar2os.com. Deletion is completed within 30 days. | Available |
| Backup retention | Automated database backups are retained for 7 days and then permanently deleted. | Confirmed |
| Control | Detail | Status |
|---|---|---|
| Penetration testing | An independent penetration test has not yet been completed. This is planned as customer volume grows. Results will be shared under NDA on request. | Planned |
| ISO 27001 | Not certified. Pillar2OS is an early-stage product. We follow ISO 27001-aligned controls where practical but do not hold formal certification. | Not yet |
| SOC 2 | Not certified. Roadmap item for enterprise tier. | Not yet |
| Vulnerability disclosure | To report a security vulnerability, email sales@pillar2os.com with subject "Security disclosure". We aim to acknowledge within 2 business days. | Available |
| Sub-processor | Category | Purpose | Location |
|---|---|---|---|
| Railway | Infrastructure | Application hosting, managed PostgreSQL database, TLS termination. All customer data resides here. | US (AWS) |
| Stripe | Payments | Subscription billing and payment processing. Pillar2OS does not store card data — it is handled entirely by Stripe. | US / EU |
| Resend | Transactional email | Sending authentication emails: magic links, password reset, email verification. Email addresses are passed to Resend for delivery only. | US |