breach notification policy

how we handle personal-data breaches.

This policy explains how Pilar detects, assesses and notifies personal-data breaches under GDPR Articles 33 and 34, and what you can expect from us if one of your personal data is ever affected.

01

Scope and purpose

This policy explains how Pilar detects, assesses and notifies personal-data breaches, and what you can expect from us if one of your personal data is affected.

It applies to withpilar.com (marketing website) and app.withpilar.com (Pilar application). It covers all personal data processed by Pilar as Data Controller, and operational coordination with our subprocessors and the independent partners listed in our Privacy Policy §07.

This policy is a public commitment. The operational playbook that supports it — on-call rotation, internal escalation, notification templates and after-action review — is maintained as an internal procedure and reviewed annually by Pilar's Data Protection Officer.

02

What counts as a personal-data breach

Under Article 4(12) of the General Data Protection Regulation (GDPR), a "personal-data breach" is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

In practice, examples we treat as reportable incidents include:

  • —An attacker obtains unauthorised access to the Pilar database or Storage buckets
  • —A subprocessor confirms a breach affecting data of Pilar users
  • —An internal mistake (misconfiguration, misdirected export) exposes personal data outside its intended audience
  • —A lost or stolen device authorised to access production systems
  • —A ransomware event that affects the availability or integrity of personal data
  • —A supply-chain compromise in a dependency used by Pilar's backend, frontend or jobs

A reportable breach is not the same as a security vulnerability that was discovered and fixed before any personal data was affected. Vulnerability reports from researchers are handled under our Security Policy; they become breach events only if exploitation of the vulnerability is confirmed or cannot be ruled out.

03

Our commitments

We hold ourselves to the following timelines, consistent with GDPR Articles 33 and 34. The Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) is our competent supervisory authority.

From detection of a possible breach:

  • —Within 4 hours — initial severity triage by Pilar's Data Protection Officer or on-call deputy, and confirmation that the 72-hour clock has started
  • —Within 24 hours — containment steps completed or in progress, affected data categories and approximate number of records identified, provisional decision on whether notification is required
  • —Within 72 hours of the moment we become aware of the breach — notification to the AEPD where GDPR Article 33(1) applies, using the AEPD's online form and, where required, following up with the detail required by Article 33(3)
  • —Without undue delay, and in any event no later than 72 hours after we become aware of the breach — notification to affected users where GDPR Article 34(1) applies (high risk to rights and freedoms), with the content required by Article 34(2)
  • —Within 14 days — a written incident report shared with any enterprise customers whose data is affected, and with Pilar's advisors
  • —Within 30 days — a public, redacted post-incident write-up where the incident warranted user notification, published on the Trust page

The 72-hour clock starts when Pilar "becomes aware" of the breach: the point at which Pilar has a reasonable degree of certainty that a personal-data breach has occurred. We start the clock at the earliest reasonable moment rather than the latest, and we file a preliminary notification to the AEPD even when the full picture is not yet available (as permitted by Article 33(4)), updating it as facts are confirmed.

04

How we detect potential breaches

Detection relies on three layers, each independent of the others so that no single failure hides a breach:

Automated signals:

  • —Sentry error monitoring (EU data region), with alerts on authentication failures, privilege errors, abnormal error rates and unexpected response-code patterns
  • —Supabase audit logs on database access, authentication events and Row-Level Security refusals
  • —Railway and Vercel platform alerts on deployment anomalies and traffic patterns
  • —Powens console alerts on webhook delivery failures and bank-connection anomalies

External signals:

  • —Reports received at [email protected] under our Security Policy vulnerability-disclosure process
  • —Notifications from any subprocessor (Supabase, Railway, Vercel, Cloudflare, Resend, Sentry, Cal.com, Mistral) under the breach-notification clauses of their respective Data Processing Agreements
  • —Notifications from Powens where a breach affects banking data they hold as independent controller
  • —Bulletins from CERT-ES, INCIBE, and relevant CVE advisories on packages used by Pilar

Internal signals:

  • —A member of Pilar reporting a mistake or suspected compromise
  • —Access review findings and our periodic review of audit logs

Each signal is routed to the Data Protection Officer. Signals outside working hours reach the on-call deputy.

05

If your data is affected: how we notify you

Where a confirmed breach is likely to result in a high risk to your rights and freedoms (GDPR Article 34(1)), we will contact you directly. We will not wait for the full 72 hours if we already have enough facts to notify earlier.

What we will tell you (GDPR Article 34(2)):

  • —A clear description of the breach in plain language
  • —The name and contact details of our Data Protection Officer or the equivalent contact for this incident
  • —The likely consequences of the breach for you specifically
  • —The measures we have taken or propose to take to address the breach and to mitigate its possible adverse effects on you
  • —The steps we recommend you take, if any (for example: change your password, review recent account activity, remain alert for phishing)

How we will reach you:

  • —By email to the address associated with your Pilar account, from [email protected], subject line prefixed [Pilar security notice]
  • —By a banner inside the Pilar application on sign-in, shown until you acknowledge it
  • —On the Trust page, as a public redacted summary, where the incident warranted user notification

Where the number of affected users makes individual notification disproportionate (GDPR Article 34(3)(c)), we will instead make a public communication or similar measure by which affected users are informed in an equally effective manner. We will not use this exception to avoid notifying you if we reasonably can.

We will never ask you, in a breach notification, to click a link to reset your password or re-enter payment details. Any breach notification that does so is not from Pilar; please report it to [email protected].

06

Notification to the supervisory authority

We notify the Spanish Data Protection Agency (AEPD, aepd.es) under GDPR Article 33(1) within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

The notification includes (GDPR Article 33(3)):

  • —The nature of the personal-data breach, including where possible the categories and approximate number of data subjects concerned, and the categories and approximate number of personal-data records concerned
  • —The name and contact details of Pilar's Data Protection Officer
  • —The likely consequences of the breach
  • —The measures taken or proposed by Pilar to address the breach, including, where appropriate, measures to mitigate its possible adverse effects

Where it is not possible to provide this information at the same time, we provide it in phases as permitted by Article 33(4), filing an initial notification within the 72-hour window and updating it as facts are confirmed.

Where the AEPD determines that a lead supervisory authority in another EU/EEA member state is competent under the one-stop-shop mechanism, we cooperate with that authority as required.

Where a breach is not notified to the AEPD because we have concluded it is unlikely to result in a risk, we document the reasoning and keep it available for the AEPD to verify, as required by GDPR Article 33(5).

07

Notifications to other parties

Powens (banking data)

Powens SAS acts as an independent Data Controller for banking data collected under PSD2, as described in Privacy §07. Where a breach affects banking data in Pilar's possession, we notify Powens without undue delay so they can fulfil their own notification obligations toward their end users and the Autorité de Contrôle Prudentiel et de Résolution (ACPR). Where Powens notifies us of a breach affecting banking data they hold, we take that into account in our own assessment and notify you under section 05 where Article 34 applies.

Employers

Where your access to Pilar was arranged by your employer and a breach affects your data, we notify you directly, not your employer. Your employer sees only the aggregated, anonymised statistics described in Privacy §05. Where a breach instead affects data your employer is the controller of (for example aggregated statistics they have been given), we notify the employer so they can fulfil any notification obligations toward their employees.

Pilar's subprocessors

Our Data Processing Agreements with each subprocessor (Supabase, Railway, Vercel, Cloudflare, Resend, Sentry, Cal.com, Mistral) require them to notify Pilar of any personal-data breach without undue delay. Pilar does not further subcontract the notification obligation: we remain accountable to you and to the AEPD for breaches affecting your data, whether they originate within Pilar or at a subprocessor.

08

After the incident

Containment is only the first phase. For every breach, including those we concluded did not need to be notified, we complete a written post-incident review that covers root cause, scope, timeline, remediation, and the specific prevention measure that will be in place before we close the incident.

Where the incident warranted user notification, we publish a redacted post-incident write-up on the Trust page within 30 days. The write-up names the component involved, the timeline, and the concrete changes we made. It does not reveal information that would make a similar attack easier to repeat.

Pilar's record of personal-data breaches (reportable or not) is maintained as required by GDPR Article 33(5) and is available to the AEPD on request.

09

Your rights

Nothing in this policy limits your rights under GDPR. In particular, in the context of a personal-data breach you may:

  • —Ask us for more information about a breach that affects your data, including the precise categories of your personal data involved — contact our Data Protection Officer
  • —Lodge a complaint with the Agencia Española de Protección de Datos (aepd.es) or with your local EU/EEA supervisory authority, free of charge
  • —Seek judicial remedy against Pilar or against the AEPD under GDPR Articles 78 and 79
  • —Seek compensation for material or non-material damage under GDPR Article 82
  • —Exercise any of your other rights set out in Privacy §09, including deletion of your account

We will not retaliate against anyone for reporting a suspected breach, lodging a complaint or exercising their rights. This applies equally to Pilar employees, researchers, customers, employers and members of the public.

10

Contact

For any question about this policy or to report a suspected breach:

Data Protection Officer: [email protected]

Security incident reports: [email protected]

General customer support: [email protected]

This policy is reviewed at least once a year, and after every incident that warranted user notification. See the related Privacy Policy, Security Policy and Trust page for the broader framework in which it sits.