Skip to content
Pikorua Security

Security & compliance

Security for the files your next tender depends on.

Certificates carry policy numbers, limits, broker contacts and, often, a sole proprietor's Social Security number used as a tax ID. Pikorua Security encrypts all of it, keeps it in the US, logs every access and never feeds it to an AI training set.

Open Trust CenterTalk to sales

Vendor record

Ridgeline Roofing Inc.

Compliant

Viewing as

General liability
GL 7741-0093-22$1,000,000 each occurrence / $2,000,000 aggregate
Endorsements
CG 20 10 04 13CG 20 37 04 13CG 24 04
FEIN
••-•••4417
AES-256 field encryptionPer-tenant KMS data key

Audit log

  1. 15:41:09P. Natarajan (Accountant) unmasked FEIN: 1099-NEC reconciliation
  2. 13:03:12Procore connector released pay app #6 on SC-0388
Type II audit of our Security, Availability and Confidentiality controls, repeated every year by an independent CPA firm
SOC 2
Type II audit of our Security, Availability and Confidentiality controls, repeated every year by an independent CPA firm
Report in the Trust Center
encryption at rest for every certificate, endorsement page, contract exhibit and audit log, with keys in AWS KMS
AES-256
encryption at rest for every certificate, endorsement page, contract exhibit and audit log, with keys in AWS KMS
Field-level for tax IDs
on every connection to the app, the API and broker upload links; TLS 1.0 and 1.1 are refused
TLS 1.3
on every connection to the app, the API and broker upload links; TLS 1.0 and 1.1 are refused
HSTS enforced
customer COIs, endorsements or contracts ever used to train our AI models
0
customer COIs, endorsements or contracts ever used to train our AI models
Written into our DPA

Zero AI training on your files

Our models learn from forms we generate, never from your certificates.

Reading a CG 20 10 04 13 correctly takes a model trained on thousands of endorsement pages. We build that corpus ourselves, so your vendors' policies never have to be part of it.

  • Isolated tenantsEach customer's files sit under their own storage prefix with their own KMS data key.
  • Models run in our AWS accountDocument AI runs inside our own environment. No third-party AI API receives your files.
  • A contractual promiseNo-training language sits in our Terms of Service and Data Processing Addendum, not just this page.

Your documents

Production AWS account

  1. 01

    Upload

    Broker link, email-in address or Procore sync

  2. 02

    Parsed in your tenant

    Tenant-scoped storage and a per-tenant KMS key

  3. 03

    Fields to your workspace

    Limits, forms, editions and deficiencies, visible only to your users

  4. 04

    Deleted on your schedule

    Retention you set, deletion on request

No network path, no copy job, no export

How our models learn

Separate training account

  1. 01

    Synthetic certificates

    ACORD 25 and 28 generated from blank layouts with fictional insureds

  2. 02

    Licensed form templates

    ISO and NCCI endorsement wording, every edition we validate

  3. 03

    Real-world noise

    Skew, fax artifacts, stamps and handwriting added synthetically

  4. 04

    Evaluated, then shipped

    Scored on a held-out synthetic set before release

Production and training run in separate AWS accounts. Customer files cannot reach the training account, and no third-party AI API ever receives them.

Infrastructure

US hosting, isolated tenants and sign-in you control.

Customer data lives on AWS in the United States. Here is how the pieces fit.

Multi-AZ in us-east-1, failover to us-west-2

Production runs across three Availability Zones in N. Virginia. Encrypted backups replicate continuously to Oregon, and we fail over at least once a year against a 1 hour recovery point and 4 hour recovery time objective.

us-east-1

Primary

N. Virginia

AZ a
AZ b
AZ c
encrypted replication

us-west-2

Standby

Oregon

Warm standby with encrypted backups and point-in-time recovery for 35 days.

Vendor tax IDs, handled as sensitive data

Field-level encryption, masked display, unmask limited to Accountants with a reason, and an automatic re-mask after 30 seconds. FEINs never reach analytics scripts, search indexes or application logs.

Tenant isolation

Every query is scoped by tenant with row-level security in the database. Automated tests attempt cross-tenant reads on every release.

Enterprise

SSO, SAML and SCIM

SAML 2.0 with Okta, Microsoft Entra ID, Google Workspace or any standards-based IdP. SCIM 2.0 adds and removes users for you, and you can require SSO for every sign-in.

MFA on every plan

Authenticator apps and passkeys for every user, enforceable by Admins. Sessions end after 12 hours idle.

Role-based permissions

Each person sees what their job needs, and nothing more.

Five roles map to how construction and property teams already split the work. Pick a role to see its column; Admins configure the workspace but cannot approve their own exceptions.
Pikorua Security permissions by role. The Risk Manager column is highlighted.
Permission
Documents
View vendor compliance statusOwn projectsFullViewViewOwn notice
Upload COIs and endorsement pagesOwn projectsFullNoneFullVia link
Request documents from a vendor or brokerOwn projectsFullNoneNoneNone
Rules and decisions
Edit contract requirement rulesNoneFullNoneNoneNone
Approve waivers and deficiency overridesNoneFullNoneNoneNone
Assemble tender defense packetsViewFullNoneNoneNone
Money and site access
Place or release payment holdsNoneFullRelease onlyNoneNone
Unmask vendor FEIN or tax IDNoneNoneWith reasonNoneNone
Lock or unlock jobsite badge accessOwn projectsFullNoneNoneNone
Administration
Manage users, roles, SSO and SCIMNoneNoneNoneFullNone
Connect Procore, Yardi or AppFolioNoneNoneNoneFullNone
Export the audit logNoneFullNoneFullNone
Set data retention and deletionNoneNoneNoneFullNone

Audit log exports

Evidence for the tender, time-stamped.

When a sub's carrier pushes back on an additional insured tender, defense counsel asks what you required, what you received and who approved it. The audit log answers in one export.

  • Every upload, verification, deficiency, notice, waiver, hold and tax ID unmask
  • Append-only and hash-chained, so a gap or edit is detectable
  • Filter by vendor, project or claim and export CSV or a signed PDF

100%

tender acceptance on claims with verified endorsement packets

How to build a tender defense package

Audit log: Harbor Point Tower 2

Append-only, hash-chained, times in UTC

  1. seq
    48221
    source_ip
    198.51.100.17
    prev_hash
    894531c3003f063d
    hash
    2c275f1853612334

Security program

Found, fixed and disclosed on a clock.

Testing runs on a fixed cadence, findings carry remediation deadlines, and incidents follow a written plan.

Testing cadence

  1. Every pull request

    Peer review by a second engineer, static analysis, dependency and secrets scanning

  2. Weekly

    Authenticated infrastructure scans and container image scans

  3. Quarterly

    Staff access reviews, phishing simulations and internal control testing

  4. Twice a year

    Incident response tabletop exercise with engineering and leadership

  5. Annually

    Independent penetration test, SOC 2 Type II audit, regional failover test and policy review

Remediation targets

Critical
7 days
High
30 days
Medium
90 days
Low
180 days

Incident response

  1. 1

    DetectMinutes

    Log, WAF and anomaly alerts page the on-call engineer around the clock.

  2. 2

    TriageWithin 1 hour

    Severity assigned and an incident commander named.

  3. 3

    ContainSame day

    Affected systems isolated, credentials and keys rotated.

  4. 4

    NotifyWithin 48 hours

    Affected customers told without undue delay once we are aware of a breach of their data.

  5. 5

    Review10 business days

    Written post-incident review with root cause and fixes.

Data retention and deletion

Keep evidence as long as claims can arrive. Delete it when you say.

Completed operations claims can surface years after a project closes, so the defaults lean long. Every setting is yours to change.
Default retention and customer controls by data type
DataDefault retentionYour controls
Certificates, endorsement pages and contract exhibits7 years after the policy expiresSet per entity from 1 to 10 years; place legal holds on a claim
Audit log7 yearsSet from 1 to 10 years; export as CSV or a signed PDF packet at any time
Vendor FEINs and tax IDsLife of the vendor recordPurge a single tax ID or the whole vendor record on demand
Broker upload linksExpire after 30 days or when the request is resolvedRevoke any link instantly
User accountsLife of the accountSCIM deprovisioning ends access the moment a user leaves your IdP

When a subscription ends you have 30 days to export. We then delete your data from production within 30 days, and it ages out of encrypted backups within a further 35 days. The Data Processing Addendum and Privacy Policy set out the full terms.

RSsecurity@
Rahul Saxena, CISSP
Security contactRahul Saxena, CISSPHead of Security & Compliance. Owns the program, the SOC 2 audit and every incident.

Responsible disclosure

Found a vulnerability? Tell us first.

Email security@pikoruasecurity.com with steps to reproduce, the affected URL or endpoint and the impact you observed. Our contact details and policy are machine-readable at /.well-known/security.txt.

  • ResponseAcknowledged within 2 business days, with a triage decision within 5.
  • In scopepikoruasecurity.com, app.pikoruasecurity.com, api.pikoruasecurity.com and broker upload links.
  • Out of scopeDenial of service, social engineering, physical attacks and scanner output without a working proof of concept.
  • Safe harborNo legal action for good-faith research that avoids privacy violations, data destruction and service disruption.
  • DisclosureGive us 90 days to fix an issue before you publish, and we will credit you if you want.
Email security teamView security.txt

Questions from security reviews

What IT and risk teams ask us most.

More detail lives in the Trust Center, our Security Policy and the subprocessor list.
Do you use our certificates or contracts to train your AI?
No. Customer COIs, endorsement pages and contracts are never used to train or fine-tune models, and that commitment is written into our Terms of Service and Data Processing Addendum. Our models are trained in a separate AWS account on synthetic ACORD certificates we generate and on licensed ISO and NCCI form templates. Production data has no path into that account, and no third-party AI service receives your files.
Where is our data stored, and who can access it?
On AWS in us-east-1 (N. Virginia) across multiple Availability Zones, with failover to us-west-2 (Oregon). Customer data stays in those US regions. Our engineers in Delhi and the US have no standing access: production sessions are requested per task, approved by a second engineer, capped at 4 hours and logged.
How do we get your SOC 2 Type II report?
Request it in the Trust Center. You accept a click-through mutual NDA and our security team sends a watermarked copy, usually within one business day. The same request can include our penetration test summary, CAIQ and SIG Lite questionnaires.
How are vendor FEINs and Social Security numbers protected?
Tax IDs are encrypted at the field level with a per-tenant key, on top of AES-256 storage encryption, and masked everywhere in the app. Only the Accountant role can unmask one, with a stated reason; the value re-masks after 30 seconds and the event is written to the audit log. Tax IDs never reach analytics scripts, search indexes or application logs.
Can a broker see other vendors or our contracts?
No. A broker upload link is signed, scoped to one request for one vendor, expires after 30 days and can be revoked at any time. The broker sees the deficiency notice, the requirement it cites and an upload box. Nothing else in your workspace is reachable from that page.
Do you support SSO and automated provisioning?
Enterprise workspaces get SAML 2.0 single sign-on with any standards-based identity provider, including Okta, Microsoft Entra ID and Google Workspace, plus SCIM 2.0 provisioning so access ends when someone leaves. Every plan supports multi-factor authentication with authenticator apps or passkeys.
What happens to our data if we cancel?
You have 30 days to export everything, including documents, verification results and the full audit log. We then delete it from production within 30 days, and it ages out of encrypted backups within a further 35 days. We certify deletion in writing on request.

Security review and trial, side by side

Run your security review while your team runs a real trial.

Request the SOC 2 Type II report and SIG Lite from the Trust Center, and test Pikorua Security on your own certificates for 14 days in the meantime.

Start free trialTalk to sales