Information Security Policy

Revision
· Last update
November 9, 2026

You rely on us to keep your data safe. Here’s how our certified security management system works, and who is accountable for it.

Policy owner Chief Operating Officer
Applies to All of Pistachio, our people and our systems

Our commitment

Pistachio AS and its subsidiaries (Pistachio) run an information security management system (ISMS) certified to ISO/IEC 27001. Our leadership backs it with the budget, people and technology it needs. We commit to three objectives:

  • Protect the confidentiality, integrity and availability of customer, company and employee data.
  • Meet the laws, regulations and contract commitments that apply to us.
  • Keep our ISO/IEC 27001 certification, and keep improving.

What our certification covers

  • Companies: Pistachio AS (Norway), Pistachio Cybersecurity Ltd (UK) and Pistachio Cybersecurity, S.L.U. (Spain).
  • Products: the Pistachio platform, including Practice and Presence, and how we build, run and support it.
  • Offices: Oslo, Valencia and London.
  • Teams: every team and every person at Pistachio.

Who is accountable

Board of Directors
Oversees cyber risk, privacy and compliance, and sets direction with executive leadership.
Executive leadership
Funds the security and privacy programme, sets its direction and reports to the Board.
ISMS Governance Council
Senior leaders from operations and engineering, led by our Chief Operating Officer. Approves policies, risks and objectives, and runs the ISMS day to day.
Chief Operating Officer
Leads our security and privacy work, and is the contact point for data protection questions.
System owners
Keep the systems they own secure and approve any access beyond the standard.
Everyone at Pistachio
Protects the information they handle, follows our policies and reports anything unusual.

How we run it

  • Risk first. We assess information security risks every year and whenever something significant changes, then choose and track the controls to treat them.
  • Clear objectives. Leadership reviews our security objectives and the plan to reach them every year.
  • Skilled people. We make sure the people in security roles have the right skills, and everyone completes security training every year.
  • Controlled documents. Our policies are approved, reviewed every year and shared with everyone they apply to.
  • Checked from inside and out. We run an internal audit and a management review every year, and an independent auditor audits us every year.
  • Always improving. When something falls short, we fix it, find the root cause and check the fix works.

Everyone's part

Everyone who works for or with Pistachio, including employees, contractors and relevant partners, must protect the information they have access to.

Where to find more

Found a vulnerability, or have a question for your security review? Email security@pistachioapp.com.
information-security-policy
Revision
· Last update
November 9, 2026

You rely on us to keep your data safe. Here’s how our certified security management system works, and who is accountable for it.

Policy owner Chief Operating Officer
Applies to All of Pistachio, our people and our systems

Our commitment

Pistachio AS and its subsidiaries (Pistachio) run an information security management system (ISMS) certified to ISO/IEC 27001. Our leadership backs it with the budget, people and technology it needs. We commit to three objectives:

  • Protect the confidentiality, integrity and availability of customer, company and employee data.
  • Meet the laws, regulations and contract commitments that apply to us.
  • Keep our ISO/IEC 27001 certification, and keep improving.

What our certification covers

  • Companies: Pistachio AS (Norway), Pistachio Cybersecurity Ltd (UK) and Pistachio Cybersecurity, S.L.U. (Spain).
  • Products: the Pistachio platform, including Practice and Presence, and how we build, run and support it.
  • Offices: Oslo, Valencia and London.
  • Teams: every team and every person at Pistachio.

Who is accountable

Board of Directors
Oversees cyber risk, privacy and compliance, and sets direction with executive leadership.
Executive leadership
Funds the security and privacy programme, sets its direction and reports to the Board.
ISMS Governance Council
Senior leaders from operations and engineering, led by our Chief Operating Officer. Approves policies, risks and objectives, and runs the ISMS day to day.
Chief Operating Officer
Leads our security and privacy work, and is the contact point for data protection questions.
System owners
Keep the systems they own secure and approve any access beyond the standard.
Everyone at Pistachio
Protects the information they handle, follows our policies and reports anything unusual.

How we run it

  • Risk first. We assess information security risks every year and whenever something significant changes, then choose and track the controls to treat them.
  • Clear objectives. Leadership reviews our security objectives and the plan to reach them every year.
  • Skilled people. We make sure the people in security roles have the right skills, and everyone completes security training every year.
  • Controlled documents. Our policies are approved, reviewed every year and shared with everyone they apply to.
  • Checked from inside and out. We run an internal audit and a management review every year, and an independent auditor audits us every year.
  • Always improving. When something falls short, we fix it, find the root cause and check the fix works.

Everyone's part

Everyone who works for or with Pistachio, including employees, contractors and relevant partners, must protect the information they have access to.

Where to find more

Found a vulnerability, or have a question for your security review? Email security@pistachioapp.com.
information-security-policy

Current version: