Security at Pillar
Security at Pillar
Security at Pillar
Pillar helps companies hedge commodity and currency risk, so our customers trust us with some of the most sensitive information in their business: their deals, positions, and cash flow. We protect it the way we’d want our own protected, with security built into how we design, build, and run Pillar.
Pillar helps companies hedge commodity and currency risk, so our customers trust us with some of the most sensitive information in their business: their deals, positions, and cash flow. We protect it the way we’d want our own protected, with security built into how we design, build, and run Pillar.
Pillar helps companies hedge commodity and currency risk, so our customers trust us with some of the most sensitive information in their business: their deals, positions, and cash flow. We protect it the way we’d want our own protected, with security built into how we design, build, and run Pillar.
Book a Demo
Encryption at rest
AES-256
Encryption in transit
TLS 1.2+
Team sign-in
SSO + MFA
Availability
Multiple zones
Our principles
Our principles
Our principles
Least privilege
Least privilege
Least privilege
People and systems get only the access they need.
People and systems get only the access they need.
Defence in depth
Defence in depth
Defence in depth
We layer controls so no single failure exposes your data.
We layer controls so no single failure exposes your data.
One standard
One standard
One standard
The same rules apply across our product, infrastructure, team, and vendors.
The same rules apply across our product, infrastructure, team, and vendors.
Always improving
Always improving
Always improving
We review and strengthen our program regularly as Pillar grows.
We review and strengthen our program regularly as Pillar grows.
Data protection
Data protection
Encryption
Customer data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.
Customer data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.
Customer data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.
Keys and secrets
Encryption keys and application secrets are held in managed services backed by hardware security modules, with tightly restricted access.
Encryption keys and application secrets are held in managed services backed by hardware security modules, with tightly restricted access.
Encryption keys and application secrets are held in managed services backed by hardware security modules, with tightly restricted access.
Hosting
Pillar is hosted in the United States on Render, a managed cloud platform, and is migrating to AWS. Our hosting providers secure the physical data centres.
Pillar is hosted in the United States on Render, a managed cloud platform, and is migrating to AWS. Our hosting providers secure the physical data centres.
Pillar is hosted in the United States on Render, a managed cloud platform, and is migrating to AWS. Our hosting providers secure the physical data centres.
Isolation
Each customer’s data is logically separated, with access enforced in the application.
Each customer’s data is logically separated, with access enforced in the application.
Backups
Data is backed up regularly, encrypted, and restore-tested.
Data is backed up regularly, encrypted, and restore-tested.
Data is backed up regularly, encrypted, and restore-tested.
Product security
Product security
Secure development
Secure development
Every code change is peer-reviewed and deployed through automated pipelines. No one changes production by hand.
Every code change is peer-reviewed and deployed through automated pipelines. No one changes production by hand.
Automated scanning
Automated scanning
Our code, dependencies, containers, and infrastructure are scanned for vulnerabilities and exposed secrets throughout development.
Our code, dependencies, containers, and infrastructure are scanned for vulnerabilities and exposed secrets throughout development.
Account controls
Account controls
Role-based permissions and activity logs let you decide who can do what in your account, and see what they did.
Role-based permissions and activity logs let you decide who can do what in your account, and see what they did.
Infrastructure and operations
Infrastructure and operations
Network
Network
Production runs in private networks, and administrative access requires multi-factor authentication.
Production runs in private networks, and administrative access requires multi-factor authentication.
Monitoring
Monitoring
We log and monitor our systems centrally and alert our engineers to suspicious activity.
We log and monitor our systems centrally and alert our engineers to suspicious activity.
Incident response
Incident response
We maintain a tested incident response plan and notify affected customers promptly, in line with our legal and contractual obligations.
We maintain a tested incident response plan and notify affected customers promptly, in line with our legal and contractual obligations.
Resilience
Resilience
We run across multiple availability zones and maintain business continuity and disaster recovery plans.
We run across multiple availability zones and maintain business continuity and disaster recovery plans.
People and access
People and access
Access
Access
Our team signs in with single sign-on and multi-factor authentication. Access is role-based, reviewed regularly, and removed promptly when someone leaves.
Our team signs in with single sign-on and multi-factor authentication. Access is role-based, reviewed regularly, and removed promptly when someone leaves.
Devices
Devices
Company laptops are centrally managed, with encryption, screen lock, and automatic updates enforced.
Company laptops are centrally managed, with encryption, screen lock, and automatic updates enforced.
Training
Training
Everyone completes security training when they join and every year after.
Everyone completes security training when they join and every year after.
Vendors
Vendors
We assess vendors’ security before they handle customer data, and review them periodically.
We assess vendors’ security before they handle customer data, and review them periodically.
AI
AI
Our AI providers are contractually prohibited from training their models on your data.
Our AI providers are contractually prohibited from training their models on your data.
Privacy
Privacy
We collect only what we need to run the service, and we never sell customer data. Read our Privacy Policy and Terms of Service.
Contact us
Contact us
Security reviews
Security reviews
Security reviews
For questionnaires or documentation, email security@pillarhq.com.
For questionnaires or documentation, email security@pillarhq.com.
Contact Security
Report a vulnerability
Report a vulnerability
Report a vulnerability
Found a security issue? Email security@pillarhq.com. We appreciate responsible disclosure and will respond promptly.
Found a security issue? Email security@pillarhq.com. We appreciate responsible disclosure and will respond promptly.
Report an Issue
Automated hedging for commodity and currency risk.
Trade associations
Disclaimer: Commodity Interest Trading involves risk and, therefore, is not appropriate for all persons; failure to manage commercial risk by engaging in some form of hedging also involves risk. Past performance is not necessarily indicative of future results. Stratos Labs, Inc. is a registered Commodity Trading Advisor (CTA) and a member of the National Futures Association.
Automated hedging for commodity and currency risk.
Trade associations
Disclaimer: Commodity Interest Trading involves risk and, therefore, is not appropriate for all persons; failure to manage commercial risk by engaging in some form of hedging also involves risk. Past performance is not necessarily indicative of future results. Stratos Labs, Inc. is a registered Commodity Trading Advisor (CTA) and a member of the National Futures Association.
Automated hedging for commodity and currency risk.
Trade associations
Disclaimer: Commodity Interest Trading involves risk and, therefore, is not appropriate for all persons; failure to manage commercial risk by engaging in some form of hedging also involves risk. Past performance is not necessarily indicative of future results. Stratos Labs, Inc. is a registered Commodity Trading Advisor (CTA) and a member of the National Futures Association.
Automated hedging for commodity and currency risk.
Trade associations
Disclaimer: Commodity Interest Trading involves risk and, therefore, is not appropriate for all persons; failure to manage commercial risk by engaging in some form of hedging also involves risk. Past performance is not necessarily indicative of future results. Stratos Labs, Inc. is a registered Commodity Trading Advisor (CTA) and a member of the National Futures Association.