This page documents how Pinnasys approaches security across infrastructure, data, applications, AI systems, and organizational processes. It is intended for clients, partners, and security researchers who want to understand our security posture.
1. Our Security Commitment
At Pinnasys, security is not a feature we bolt on at the end — it is embedded in every phase of how we build, deploy, and operate AI systems. From initial architecture decisions to production monitoring, we apply security-first engineering principles across every client engagement.
We are committed to maintaining the confidentiality, integrity, and availability of client data and the AI systems we deliver. Our security practices evolve continuously to address new threats, regulatory requirements, and the unique risks introduced by AI workloads.
2. Infrastructure Security
All Pinnasys-managed systems and client-facing infrastructure are hosted on enterprise-grade cloud platforms including Amazon Web Services (AWS). These platforms provide foundational security controls including physical security, hardware redundancy, and network isolation.
- Virtual Private Clouds (VPCs) with private subnets and security group rules to restrict network access.
- Web Application Firewalls (WAF) deployed in front of public-facing APIs and web applications.
- DDoS protection enabled at the network and application layers.
- Infrastructure-as-Code (IaC) practices to ensure consistent, auditable environment configurations.
- Automated patch management to keep operating systems and dependencies up to date.
- Multi-region redundancy and failover for high-availability workloads where required.
3. Data Security
Client data is treated as confidential by default. We apply strict data handling controls throughout the data lifecycle — from ingestion to processing, storage, and deletion.
Encryption
- Data in transit: All communications are encrypted using TLS 1.2 or higher.
- Data at rest: Sensitive data is encrypted using AES-256 in managed storage services.
- Database encryption: Managed database services use encryption at the storage layer.
Data Isolation
- Client data environments are logically isolated from one another.
- Production and non-production (development/staging) environments are strictly separated.
- Personal and sensitive data is never used in development or testing environments without anonymization.
Data Minimization
- We collect and retain only the data required to deliver services.
- Data retention schedules are defined per engagement and data is securely deleted when no longer needed.
- AI model training data is reviewed to ensure it does not contain unnecessary PII.
4. Access Control & Identity
Controlling who can access what is one of the most effective security controls we apply. Our access management practices are built around the principle of least privilege.
- Role-Based Access Control (RBAC) is enforced across all internal systems and client environments.
- Multi-Factor Authentication (MFA) is mandatory for all team members accessing cloud consoles, code repositories, and internal tools.
- SSH key-based authentication is required for server access; password-based SSH is disabled.
- Service accounts and API keys are scoped to minimum required permissions and rotated regularly.
- Access to client systems is provisioned only for team members actively working on that engagement and revoked immediately upon project completion.
- All privileged access activities are logged and reviewed periodically.
5. Application & AI Security
Building AI systems introduces security considerations beyond traditional software. We address both conventional application security and AI-specific risks throughout the development lifecycle.
Secure Development Practices
- Code is reviewed by peers before merging to main branches.
- Static code analysis and dependency scanning (SCA) are integrated into CI/CD pipelines.
- Secrets and API keys are stored in secrets management services — never hardcoded in source code.
- OWASP Top 10 risks are addressed as part of our standard development process.
AI-Specific Security
- Prompt injection defenses are implemented in all LLM-integrated applications.
- Model outputs are validated and sanitized before being surfaced to end users.
- Retrieval-Augmented Generation (RAG) pipelines enforce document-level access controls to prevent data leakage.
- AI agents are sandboxed with defined tool boundaries to limit unintended system interactions.
- Model versioning and audit trails are maintained to support accountability and rollback.
6. Monitoring & Incident Response
Continuous visibility into system behavior is essential for detecting and responding to security events quickly.
- Centralized logging and monitoring are configured for all production workloads.
- Anomaly detection and alerting are set up for unusual access patterns, API abuse, and infrastructure events.
- Security events are triaged with defined severity levels and response times.
- A documented incident response plan is in place covering detection, containment, eradication, recovery, and post-incident review.
- Clients are notified promptly of any confirmed security incident affecting their data, in accordance with applicable data breach notification laws.
7. People & Organizational Security
Security is a shared responsibility. Every Pinnasys team member plays a role in maintaining a secure environment.
- All new hires undergo background screening as part of the onboarding process.
- Security awareness training is conducted regularly covering phishing, social engineering, and safe data handling.
- Employees with access to client data sign Non-Disclosure Agreements (NDAs) as a condition of employment.
- Clear policies govern acceptable use of company systems, data, and devices.
- Access credentials are immediately revoked upon team member offboarding.
8. Client Confidentiality & NDAs
Pinnasys understands that prospective and active clients share sensitive business information during engagements. We treat all such information as confidential by default.
We are prepared to execute mutual Non-Disclosure Agreements (NDAs) before any sensitive information is shared. NDAs are a standard part of our pre-engagement process, and we can turn around a signed agreement quickly to avoid delays.
Our standard NDA covers business concepts, technical architectures, product roadmaps, data, and any other proprietary information shared during or in connection with an engagement.
9. Compliance & Regulatory Alignment
While Pinnasys is not a compliance certification body, our practices are designed to support clients operating in regulated industries. We build systems that align with the security controls and documentation requirements of relevant frameworks:
- GDPR and UK GDPR: Data minimization, access controls, retention policies, and breach notification procedures.
- CCPA: Consumer data rights, opt-out mechanisms, and data inventory practices for US-based clients.
- HIPAA-aware architectures: Segregated environments, audit logging, and encryption for healthcare clients.
- SOC 2 alignment: Our cloud infrastructure providers hold SOC 2 Type II certifications.
- India IT Act 2000 and DPDP Act: Compliance with Indian data protection obligations for data processed within India.
10. Responsible Disclosure
We welcome responsible disclosure of security vulnerabilities from security researchers and the broader community. If you believe you have discovered a security issue affecting Pinnasys systems or our website, please report it to us privately so we can investigate and address it before any public disclosure.
To report a vulnerability, email us at hr@pinnasys.com with the subject line "Security Vulnerability Report". Please include:
- A clear description of the vulnerability and the affected system or URL.
- Steps to reproduce the issue.
- Potential impact if the vulnerability were exploited.
- Your contact information for follow-up (optional but appreciated).
We commit to acknowledging your report within 5 business days, keeping you informed of our progress, and not pursuing legal action against researchers who follow responsible disclosure practices. We do not currently operate a paid bug bounty program.
11. Security Contact
For security concerns, vulnerability reports, or questions about our security practices, please contact us directly: