security, privacy, and how pilar handles data.

All employee data is encrypted at rest and in transit.

Encryption in transit

• —TLS enforced end-to-end with modern cipher suites
• —HTTP Strict Transport Security enabled with preload eligibility
• —Enforced at both the CDN edge and the application layer

Encryption at rest

• —AES-256 encryption of all databases and backups
• —Encryption key management via managed cloud secret providers, with per-deployment rotation on any suspected exposure

Authentication and password handling

• —User passwords are cryptographically hashed via Supabase Auth using industry-standard algorithms
• —Asymmetric JWT verification against Supabase JWKS on every authenticated request

HTTP security headers (applied to every response)

• —Content-Security-Policy
• —Strict-Transport-Security (HSTS)
• —X-Frame-Options
• —X-Content-Type-Options
• —Referrer-Policy
• —Permissions-Policy

Pilar operates in Europe under the following regulatory framework.

MiFID II

Pilar provides financial information and educational content. Pilar does not provide investment advice, portfolio management, or personal recommendations as defined under MiFID II Article 4(1)(4). Pilar does not manage client assets and is not authorised as an investment firm. Educational content is designed by CFA-charter holders and reviewed by academic partners; no output from Pilar constitutes a personal recommendation to any individual.

PSD2

Pilar ingests bank account data via two paths: (a) user-uploaded CSV statements, with no direct connection to bank APIs; and (b) an open banking connection operated by Powens SAS, a French Payment Institution regulated under PSD2 (see Section 06). Pilar does not initiate payments, hold customer funds, or perform any Payment Initiation Service Provider (PISP) functions.

GDPR

Pilar acts as a data controller for individual user data and processes data on the basis of user consent (Article 6(1)(a)) and contract performance (Article 6(1)(b)). Where an employer contracts Pilar for its workforce, Pilar remains the controller of individual employee data; the employer is not a joint controller of individual data and cannot compel disclosure of it under any contractual provision. Employer aggregate reporting is provided pursuant to a separate processing basis.

DORA

Pilar is not currently in scope of the Digital Operational Resilience Act as a regulated financial entity. We monitor operational resilience standards applicable to our fintech-adjacent operations and align to them where relevant.

Data Protection Officer: [email protected]

Regulatory / compliance: [email protected]

Pilar's current security posture:

External security audit programme

Pilar has completed two comprehensive external security audits. The audits produced a multi-phase remediation programme covering credential hygiene, input validation, authorisation, injection resistance, security headers, rate limiting, JWT hardening, and CI security scanning. All critical and high findings have been remediated and independently re-verified. A summary of findings and remediations is available under NDA to enterprise prospects and customers.

Penetration testing

Full external penetration test scheduled for Q4 2026. Report will be available under NDA to enterprise prospects and customers.

ISO 27001

Certification programme initiated in Q1 2027. Target completion: Q2 2027. Progress and interim controls documentation available on request.

SOC 2 Type II

Under evaluation for 2027, subject to demand from enterprise customers.

Continuous security scanning (in production today)

• —Static application security testing (SAST) on every commit
• —Dependency vulnerability scanning with automated pull requests on any published CVE, and disciplined patching within the CVE publication window
• —Secret scanning in the codebase and pre-commit hooks
• —Regular expression denial-of-service (ReDoS) static analysis and runtime timing checks
• —All security-scanning jobs are required to pass before deployment

We do not currently hold ISO 27001 or SOC 2 certifications. We are transparent about this. Our security architecture is designed to meet the substantive controls of both frameworks in advance of formal certification.

Pilar uses the following subprocessors. Powens is described separately in Section 06 because it acts as an independent Data Controller rather than a Pilar subprocessor.

Infrastructure and hosting

• —Vercel — frontend hosting (US company, global CDN edge)
• —Railway — backend hosting (US company, EU West / Amsterdam)
• —Supabase — Postgres database and authentication (US company, EU / Frankfurt); Supabase Storage buckets currently US, EU migration planned Q1 2027
• —Cloudflare — DNS (global)

Communication and support

• —Resend — transactional email (US company, US-processed)
• —Cal.com — booking (US-hosted; region unavailable on current tier)

Analytics and observability

• —Vercel Web Analytics — privacy-first, cookie-free
• —Sentry — application error tracking (US company, EU data region)

We maintain data processing agreements with all subprocessors listed above. For subprocessors that process personal data outside the EEA, transfer is governed by Standard Contractual Clauses and, where applicable, EU-US Data Privacy Framework certification.

We notify users of new or changed subprocessors 30 days in advance via email.

Bank connections are handled by Powens, an ACPR-regulated payment institution.

When you connect a bank account to Pilar, the connection is operated by Powens SAS, a French Payment Institution regulated by the Autorité de Contrôle Prudentiel et de Résolution (ACPR), CIB number 16948, SIREN 749 867 206.

Role and legal framing

Powens acts as an independent Data Controller (not a Pilar subprocessor) of the banking data collected via PSD2. When you initiate a bank connection you are redirected to Powens' Webview and enter into a direct relationship with Powens, subject to Powens' own Terms of Use (https://www.powens.com/terms-and-conditions-of-sale/) and End-User Privacy Policy (https://www.powens.com/privacy-policy-of-end-user-personal-data/). Pilar and Powens each act as independent Data Controllers within our respective scopes: Powens for the PSD2 collection from your bank; Pilar for the display, categorisation, and analysis within our product.

What Pilar never touches

• —Bank login credentials — those are entered directly with Powens through their regulated PSD2 interface; Pilar never sees or stores them
• —Individual banking data at the employer level — no bank account, balance, transaction, or holding is ever surfaced to your employer in any form
• —Payment initiation — Pilar does not initiate payments, hold your funds, or perform any Payment Initiation Service Provider (PISP) functions

Data flow

When you connect a bank account, data flows: your bank → Powens (encrypted, France, EU) → Pilar backend (Railway, EU) → Pilar database (Supabase, eu-west-1). Pilar's backend fetches banking data from Powens on a monthly schedule (typically the 5th of each month) rather than continuously. This is deliberate: less frequent syncing means less data in transit and reduces the frequency at which your bank sees data-access requests.

Powens infrastructure and regulatory status

Powens' own public security disclosures are published at https://www.powens.com/security-compliance/.

Consent, retention, and disconnection

Your consent to open banking data collection is renewed every 180 days per PSD2. You can disconnect any bank account at any time from your Pilar settings; disconnection instructs both Pilar and Powens to cease active synchronisation. On disconnection, Powens retains the associated data for a maximum of 30 days before permanent destruction. Data previously delivered to Pilar remains subject to Pilar's own retention rules (see Section 07).

Because Powens is an independent Data Controller and not a Pilar subprocessor, your rights over data held by Powens (access, correction, erasure) may also be exercised directly with Powens per their Privacy Policy.

Pilar retains data only as long as necessary to provide the service and meet legal obligations.

Active users

• —Personal profile and financial data: retained for the duration of active account use
• —Session logs and engagement data: 24 months
• —Audit logs (system access): 24 months

Deactivated users (employee leaves employer)

• —Automatic data anonymisation triggers 90 days after account deactivation, unless the user has migrated to a personal subscription or has objected to anonymisation within the 90-day window
• —Anonymised aggregate data may be retained indefinitely for product improvement and academic research

User-initiated deletion

• —Individual users can request full account deletion at any time via their account settings or by writing to [email protected]
• —Deletion is completed within 30 days of request
• —Confirmation of deletion is sent to the user's registered email

Employer-initiated data return

• —Employer-level aggregate reports are retained for 24 months after contract end, then deleted
• —No individual employee data is ever released to a departing employer, regardless of contract terms

Open banking data (Powens)

On disconnection of a bank account, Powens retains the associated data for a maximum of 30 days before permanent destruction. Data previously delivered to Pilar remains subject to the Pilar retention rules above.

Legal holds

Data subject to a legal hold (e.g., regulatory investigation) is retained for the period required by law and remains subject to standard security controls throughout.

Pilar maintains an incident response plan covering:

• —Detection: continuous CI security scanning; automated dependency vulnerability alerts; application error tracking via Sentry; anomaly logging with alerting on threshold breach
• —Triage: severity classification within 4 hours of detection
• —Containment: immediate isolation of affected systems where applicable
• —Notification: affected users notified within 72 hours of confirmed personal data breach, in accordance with GDPR Article 33 and 34
• —Post-incident review: written incident report within 14 days, shared with affected customers

Customer notification contacts are collected during onboarding and kept up to date via annual review.

For incidents affecting banking data collected via Powens, notification chains between Powens and Pilar are governed by our contract with Powens; end-user notification is issued by Pilar to affected users within the 72-hour GDPR window.

We have not experienced a security breach to date. Should one occur, we commit to timely, honest, and detailed communication.

Users

• —Strong password requirements aligned with NIST SP 800-63B guidance; no forced rotation, no arbitrary character-class rules
• —Password strength assessed at registration
• —Two-factor authentication available for all users via any standard authenticator app (Google Authenticator, Authy, 1Password, and equivalents)
• —Passkey (WebAuthn) support planned for 2027
• —Suspicious login detection: unusual location, device, or pattern triggers step-up authentication

Employer administrators

• —Two-factor authentication required for all employer admin roles
• —Single sign-on (SAML) available on request

Application-level protections

• —Per-user and per-endpoint rate limiting enforced at both the application layer and the CDN edge
• —Explicit ownership checks on every endpoint that touches user-owned resources, covered by a dedicated test suite
• —Strict request-body validation on every write endpoint

Pilar personnel

• —All Pilar accounts protected by hardware security key (WebAuthn)
• —Production database access requires hardware-key two-factor authentication; every access event is logged
• —No shared credentials

Security and compliance contact

Security researchers and responsible disclosure: [email protected]

Data protection and GDPR requests: [email protected]

General compliance questions: [email protected]

We respond to security disclosures within 48 hours and welcome responsible disclosure. No formal bug bounty at this stage; we credit reporters publicly with permission.