How we protect your data

SOC 2 Type II

Pimetric maintains a SOC 2 Type II report covering the Security, Availability, and Confidentiality trust service criteria. The report is renewed annually by an independent CPA firm. Customers under mutual NDA can request a copy by emailing trust@pimetric.com.

FCRA

When used to make tenancy decisions, Pimetric operates as a Consumer Reporting Agency under the Fair Credit Reporting Act. We maintain the dispute, accuracy, and disclosure procedures the FCRA requires.

Other

Vendor diligence, change management, and incident response controls are mapped to the AICPA Trust Services Criteria and to relevant state-level data-protection statutes (CCPA, NY SHIELD, MA 201 CMR 17, TX HB 4 among others).

Pimetric never sees bank credentials. The applicant connects through our regulated banking-data partner's OAuth flow — usernames, passwords, and MFA codes are exchanged directly with the bank.

We receive a read-only feed of transactions and balances. The feed is one-way: we cannot move money, originate transfers, or change account settings.

• Transactions and balances are encrypted at rest with AES-256.
• Each applicant's data is logically isolated by tenant ID and access-checked on every read.
• Raw bank feeds are purged 24 months after the report is generated.
• Generated reports are retained for 7 years to satisfy FCRA recordkeeping, then permanently deleted.

In transit

All traffic between you, our edge, and our internal services flows over TLS 1.3 with modern cipher suites. HSTS is enforced with preload submission for the pimetric.com domain.

At rest

Application databases and object storage use AES-256 envelope encryption with keys managed in a managed KMS. Sensitive fields (bank tokens, MFA seeds) carry a second layer of envelope encryption using per-tenant data keys.

Key management

Master keys are rotated annually and on any suspected compromise. Engineers cannot export raw key material; key usage is logged and monitored.

• Single sign-on with hardware-backed multi-factor authentication is required for every Pimetric employee.
• Production access is granted on a least-privilege basis, scoped per role, and reviewed quarterly.
• Just-in-time elevation: engineers request temporary access for a specific incident; access expires automatically.
• All production actions are logged to an append-only audit trail retained for at least 1 year.
• Customer-side: dashboard accounts support SSO (SAML 2.0 / OIDC) on Professional and Enterprise tiers.

The Service runs in U.S. regions of a top-tier cloud provider with ISO 27001, SOC 2, and PCI DSS attestations. Logical multi-tenancy isolates customer data with row-level checks enforced at the application boundary.

We do not transfer applicant data outside of the United States without explicit consent. Backups are encrypted, geographically redundant within U.S. regions, and tested quarterly.

• Every code change is peer-reviewed and runs through automated static analysis, dependency scanning, and secret scanning before merge.
• Container images are signed and scanned for known CVEs on each build.
• Production deploys are immutable, traceable to a Git SHA, and reversible within minutes.
• Third-party dependencies are pinned and updated on a published cadence.

Pimetric engages an independent firm for a full-scope external penetration test at least once a year. Findings and remediation status are summarized in our SOC 2 report.

We run a private bug-bounty program for security researchers. Eligible reports receive monetary rewards and public credit at the researcher's option. To participate or to disclose a vulnerability, see “Reporting a vulnerability” below.

We maintain a documented incident response plan tested at least twice a year. If we determine that a security incident has resulted in unauthorized access to customer data, we will:

• Notify affected customers without undue delay and in any case within 72 hours of confirmation.
• Provide a description of the data involved, the mitigation steps taken, and any actions you should take.
• Cooperate with regulators and law enforcement as required.
• Publish a public post-mortem on material customer-impacting incidents.

Our incident channel is monitored 24/7. Status and uptime are published at status.pimetric.com.

Every subprocessor we use undergoes a written security review covering encryption, access control, incident response, data residency, and compliance posture. We sign a data processing agreement with each, list them publicly, and notify customers in advance of material changes. Our current subprocessor list is available at trust@pimetric.com.

If you believe you have found a security vulnerability in Pimetric, please email security@pimetric.com with steps to reproduce. We acknowledge reports within one business day and aim to triage within five.

Please act in good faith — give us a reasonable window to fix before public disclosure, do not access data beyond what is necessary to demonstrate the issue, and do not run automated scanners that degrade availability.

PGP key fingerprint and a copy of our security.txt are available at /.well-known/security.txt.

General security questions: security@pimetric.com
Trust & compliance documents: trust@pimetric.com