Everything your vendor security review asks for, in one place.

Staff SSO with phishing-resistant MFA

Every Pikorua Security employee signs in through SSO with a FIDO2 security key. Passwords alone never grant access to internal systems.

No standing access to customer data

Production access is requested per session, approved by a second engineer, limited to 4 hours and recorded.

Quarterly access reviews

System owners recertify every staff account and permission each quarter; changes are applied within 24 hours.

Same-day offboarding

SSO, laptop and production access are revoked on an employee's last day, triggered from the HR system.

Customer roles and SSO

Five in-product roles with least privilege, SAML 2.0 single sign-on and SCIM 2.0 provisioning on Enterprise.

AES-256 encryption at rest

Databases, object storage, queues and backups are encrypted with AES-256 using keys held in AWS KMS.

TLS 1.3 in transit

TLS 1.3 on the app, API and upload links with HSTS. TLS 1.0 and 1.1 are refused; TLS 1.2 only on legacy integration endpoints.

Field-level encryption for tax IDs

FEINs and TINs are envelope-encrypted with a per-tenant data key, masked by default and unmasked only by Accountants with a logged reason.

Key rotation and separation

KMS keys rotate annually. Each customer tenant has its own data key, and key use is logged in AWS CloudTrail.

Centralized, tamper-resistant logs

Application, infrastructure and access logs are centralized, write-protected, kept online 1 year and archived up to 7 years.

Around-the-clock alerting

Suspicious sign-ins, privilege changes and unusual export volumes page the on-call engineer 24 hours a day.

Customer audit log

Every upload, verification, rule change, waiver, hold and tax ID unmask is logged in a hash-chained record customers can export.

Incident response plan

Defined severities, roles and customer notice within 48 hours of becoming aware of a breach; tabletop tested twice a year.

Vulnerability management

Continuous dependency and image scanning, weekly authenticated scans and an annual independent penetration test.

Peer-reviewed changes

Every pull request needs approval from a second engineer before it can merge to the main branch.

Automated security testing

Static analysis, dependency checks and secrets detection run on every pull request and block the merge on failure.

Infrastructure as code

AWS resources are defined in code, reviewed like application code, and production, staging and development live in separate accounts.

Security review for sensitive changes

Changes to authentication, permissions or encryption need sign-off from the security team before release.

Multi-AZ hosting with regional failover

Production runs across multiple Availability Zones in us-east-1 with a warm standby in us-west-2.

Continuous encrypted backups

Point-in-time recovery for 35 days, with encrypted copies replicated to us-west-2.

Annual failover test

We fail over to us-west-2 at least once a year against a 1 hour recovery point and 4 hour recovery time objective.

Vendor risk reviews

Subprocessors are assessed before onboarding and every year after, using their SOC 2 or ISO/IEC 27001 reports.