Security Information


Overview

At PinnacleAP, security is our top priority. Our Technology Expense Management (TEM) platform is built on Microsoft Azure, leveraging industry-leading security measures to ensure the confidentiality, integrity, and availability of our clients’ data. We adhere to best practices and compliance standards to provide a secure and reliable solution.

Data Security

Encryption

  • Data at Rest: All stored data is encrypted using AES-256 encryption.
  • Data in Transit: Data transmitted between users, applications, and cloud services is protected with TLS 1.2+ encryption.

Access Control

  • Role-Based Access Control (RBAC) ensures users only have access to the data and functions necessary for their role.
  • Multi-Factor Authentication (MFA) is enforced for all administrator and privileged accounts.
  • Azure Active Directory (AAD) Integration for seamless and secure identity management.

Infrastructure Security

Network Protection

  • Azure Firewall & DDoS Protection safeguards our environment from external threats.
  • Virtual Network (VNet) Isolation ensures secure network segmentation.
  • Private Endpoints & VPN Access limit exposure to the public internet.

Threat Detection & Monitoring

  • Azure Security Center continuously monitors security posture and alerts on potential vulnerabilities.
  • Advanced Threat Protection (ATP) detects and mitigates threats in real time.
  • SIEM Integration with Azure Sentinel for centralized logging and threat intelligence.

Compliance & Certifications

We align with industry standards to ensure compliance with security and privacy regulations:

  • SOC 2 Type II – Security, Availability, and Confidentiality

 

Incident Response & Business Continuity

Incident Management

  • 24/7 security monitoring with automated incident response mechanisms.
  • Defined Incident Response Plan (IRP) to address security breaches and vulnerabilities promptly.

Backup & Disaster Recovery

  • Geo-Redundant Storage (GRS) ensures high availability.
  • Regular Backup & Restore Testing to verify data integrity and recovery efficiency.
  • Disaster Recovery Plan (DRP) with predefined RTO/RPO objectives.

User Best Practices

To maintain a high level of security, we recommend users follow these best practices:

  • Use strong, unique passwords and enable MFA.
  • Avoid sharing login credentials.
  • Report any suspicious activity immediately to our security team.

For any security concerns or inquiries, please contact our security team at [[email protected]].