Pillar2OS Information Security Protocol

Dependency scanning

• GitHub Dependabot is configured for both vellum-backend (pip) and vellum-frontend (npm), running weekly scans every Monday.
• Dependency PRs are limited to 5 open at a time per ecosystem; they are triaged and merged within 7 days for critical/high findings, 30 days for medium/low.
• npm audit is run as part of the CI build; the build fails on high or critical npm vulnerabilities.

Patch management SLAs

• Critical (CVSS 9.0+): Patch applied and deployed within 24 hours of confirmed exploitation path.
• High (CVSS 7.0–8.9): Within 7 days.
• Medium (CVSS 4.0–6.9): Within 30 days.
• Low (CVSS < 4.0): Addressed in next planned maintenance window.

Vulnerability disclosure

To report a security vulnerability in Pillar2OS, email security@pillar2os.com. We aim to acknowledge reports within 48 hours and to provide an initial assessment within 5 business days. We follow responsible disclosure and will coordinate a fix timeline with the reporter before public disclosure.

Audit logs are append-only and cannot be modified by application users. Access to raw logs is restricted to named Pillar2OS engineers. Customers can access their own audit trail within the platform under Settings → Audit Log.

Incident classification

• P1 — Critical: Confirmed data breach; active exploitation of a vulnerability; platform-wide unavailability. Response within 1 hour.
• P2 — High: Suspected breach; significant degradation affecting multiple customers; credential compromise. Response within 4 hours.
• P3 — Medium: Isolated security anomaly; single-customer degradation; potential unauthorised access attempt. Response within 24 hours.
• P4 — Low: Security policy violation without immediate risk; minor availability issues. Response within 5 business days.

Response procedure

• Detection: Incident detected via monitoring alerts, customer report, or internal discovery.
• Triage: Assign severity (P1–P4). Assemble response team. Isolate affected systems if required.
• Containment: Revoke compromised credentials; rotate affected secrets; block attack vector.
• Investigation: Determine scope, root cause, and affected data/users using audit logs and system logs.
• Notification: Affected customers notified within 48 hours of confirmation. ICO notified within 72 hours for personal data breaches (as required by UK GDPR Article 33).
• Remediation: Deploy fix; verify resolution; restore service.
• Post-incident review: Within 5 business days: root cause analysis, timeline, lessons learned, preventive measures documented.

Contact

To report a security incident: security@pillar2os.com. For urgent incidents, prefix the subject line with [P1 URGENT].

All sub-processors are assessed for security posture before engagement. Assessment criteria include:

• ISO 27001 certification or equivalent SOC 2 Type II report.
• Data residency confirmation (EU/UK or documented transfer mechanism).
• Written DPA and sub-processing agreement.
• Breach notification commitment ≤ 48 hours.

The current sub-processor list is published in the DPA. Customers will be notified at least 14 days before any new sub-processor is added, with the right to object.

Infrastructure hosting credentials are rotated quarterly or immediately on personnel change. Shared credentials are not used.

• Access provisioning: Production access is provisioned on a need-to-know basis and reviewed monthly. Access is revoked within 1 business day of role change or departure.
• Security awareness: All personnel with access to production systems complete security awareness training annually covering phishing, social engineering, and data handling.
• Device security: Devices used to access production systems must have full-disk encryption enabled and run current OS security patches.
• Confidentiality obligations: All personnel sign confidentiality agreements as a condition of engagement.
• Background checks: Employment screening is conducted for all personnel with access to Highly Confidential data, subject to applicable law.