Our Approach to Security
You trust us with your people’s data. Here’s how we protect it, and why we do it this way.
How we think about security
Pistachio AS and its subsidiaries (Pistachio) run Practice and Presence on one platform (Platform). Your data lives in the Platform, so that is where our security starts.
Access
- Each customer’s data is kept logically separate from every other customer’s.
- Our people only access your data when needed to deliver or support the service, or when the law requires it.
- Multi-factor authentication protects all privileged access, and everyone uses a company password manager.
- Privileged access is granted only for as long as a task needs it, and every privileged login is logged.
- We review access rights every quarter and whenever someone changes role. Our checked offboarding process removes people’s access when they leave.
Building and testing
- Every code change is peer reviewed and approved before it goes live.
- Production is kept separate from development and test, and your data is never used for testing.
- Production networks are segmented and hardened, with intrusion detection in place.
- Vulnerabilities are fixed in order of severity.
- Independent security experts regularly test the Platform.
People and devices
- We run background checks on new hires where local law allows.
- Everyone completes security training when they join and every year after that.
- We run regular phishing simulations on our own Practice platform.
- Company laptops are encrypted and centrally managed.
- Our offices have controlled entry and visitor management, and our staff are trained to follow it.
Resilience
- The Platform runs across multiple zones, so a single failure does not take it down.
- Backups run automatically and are encrypted.
- Production activity is logged and continuously monitored, with alerts for anything suspicious.
- If an incident affects your data, we tell you quickly, as set out in our Data Processing Agreement.
Where to find more
- Data Processing Agreement: our full technical and organisational measures (Appendix B), breach notification and sub-processors.
- Privacy Notice: what personal data we process, where it is stored and how long we keep it.
- Permissions: what we access in your Microsoft tenant, why, and how you control admin access.
- Information Security Policy: what our certification covers and who is accountable.
- AI Policy: how we use AI, with people in control. Your data is never used to train AI models.
- Supplier Code of Conduct: what we expect from our suppliers, who are security reviewed before we use them.
our-approach-to-security
You trust us with your people’s data. Here’s how we protect it, and why we do it this way.
How we think about security
Pistachio AS and its subsidiaries (Pistachio) run Practice and Presence on one platform (Platform). Your data lives in the Platform, so that is where our security starts.
Access
- Each customer’s data is kept logically separate from every other customer’s.
- Our people only access your data when needed to deliver or support the service, or when the law requires it.
- Multi-factor authentication protects all privileged access, and everyone uses a company password manager.
- Privileged access is granted only for as long as a task needs it, and every privileged login is logged.
- We review access rights every quarter and whenever someone changes role. Our checked offboarding process removes people’s access when they leave.
Building and testing
- Every code change is peer reviewed and approved before it goes live.
- Production is kept separate from development and test, and your data is never used for testing.
- Production networks are segmented and hardened, with intrusion detection in place.
- Vulnerabilities are fixed in order of severity.
- Independent security experts regularly test the Platform.
People and devices
- We run background checks on new hires where local law allows.
- Everyone completes security training when they join and every year after that.
- We run regular phishing simulations on our own Practice platform.
- Company laptops are encrypted and centrally managed.
- Our offices have controlled entry and visitor management, and our staff are trained to follow it.
Resilience
- The Platform runs across multiple zones, so a single failure does not take it down.
- Backups run automatically and are encrypted.
- Production activity is logged and continuously monitored, with alerts for anything suspicious.
- If an incident affects your data, we tell you quickly, as set out in our Data Processing Agreement.
Where to find more
- Data Processing Agreement: our full technical and organisational measures (Appendix B), breach notification and sub-processors.
- Privacy Notice: what personal data we process, where it is stored and how long we keep it.
- Permissions: what we access in your Microsoft tenant, why, and how you control admin access.
- Information Security Policy: what our certification covers and who is accountable.
- AI Policy: how we use AI, with people in control. Your data is never used to train AI models.
- Supplier Code of Conduct: what we expect from our suppliers, who are security reviewed before we use them.
our-approach-to-security
Current version: