Snapshot 208204
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Pin Trust Center Welcome to Pin's Trust Center, where our commitment to data privacy and security is core to our business. This Trust Center offers detailed insights into our security practices, including the specific controls and policies implemented by our teams. You can explore our compliance standards, request access to comprehensive security documentation, and gain a clear understanding of how we safeguard your data. Additionally, we invite you to subscribe for updates to stay informed about the latest advancements in our security and compliance initiatives. Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation. Skip to main content Pin Trust Center Welcome to Pin's Trust Center, where our commitment to data privacy and security is core to our business. This Trust Center offers detailed insights into our security practices, including the specific controls and policies implemented by our teams. You can explore our compliance standards, request access to comprehensive security documentation, and gain a clear understanding of how we safeguard your data. Additionally, we invite you to subscribe for updates to stay informed about the latest advancements in our security and compliance initiatives. support@pin.com ⌘K OverviewDocumentationControlsSubprocessorsUpdatesSecurity Certifications Trusted by Lithic Expa Range Radar Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Documentation Featured SOC 2 Type II Report Web, API, and Network Penetration Testing Report Pin Algorithmic Fairness Report (August 2026) Subprocessors Amazon Web Services · United States Hosts all of Pin’s data and web infrastructure United States Anthropic · United States AI and LLM models United States Cloudflare · United States Serves as a WAF, DNS, and CDN for Pin services United States Google Cloud · United States We use Google’s Generative AI and LLM models United States Langfuse · United States To help debug AI and LLM services United States Controls Access control Layered authentication and authorization safeguards restrict system access to only approved users and keep customer data protected. Multi-factor authentication for privileged access Role-based access control Unique credentials and strong password policy Formal access provisioning and deprovisioning Quarterly access reviews and recertification Data security Comprehensive safeguards protect customer information throughout its lifecycle, from classification to encryption and secure disposal. Encryption at rest Encryption in transit Data classification policy Data retention and secure disposal Production-only customer data handling Security monitoring and logging Automated tools continuously watch for suspicious activity, generate real-time alerts and provide visibility into system performance and threats. Centralized log management with alerting Network intrusion detection system System performance and availability monitoring Anti-malware protection Targeted security alert routing Updates Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Controls Access control Layered authentication and authorization safeguards restrict system access to only approved users and keep customer data protected. Multi-factor authentication for privileged access Administrators must present a valid second authentication factor before they can reach production infrastructure, reducing the risk of account takeover and unauthorized system changes. Role-based access control Privileges to networks, applications, operating systems and data stores are granted strictly on the principle of least privilege, ensuring users receive only the access required for their job responsibilities. Unique credentials and strong password policy Every user authenticates with an individual account that follows enforced complexity, length and rotation requirements, strengthening defenses against brute-force and credential-stuffing attacks. Formal access provisioning and deprovisioning All new access requests require documented manager approval and access is removed within 24 hours of termination, limiting exposure from orphaned or excessive accounts. Quarterly access reviews and recertification Management conducts documented quarterly reviews of all high-risk systems to verify that permissions remain appropriate and to promptly revoke or adjust any unnecessary rights. Data security Comprehensive safeguards protect customer information throughout its lifecycle, from classification to encryption and secure disposal. Encryption at rest All databases and storage services containing customer information are configured for server-side encryption, preventing unauthorized reading of stored data. Encryption in transit Secure transport protocols are enforced to encrypt customer data whenever it traverses public or untrusted networks, mitigating eavesdropping and tampering risks. Data classification policy A documented framework assigns sensitivity levels to information assets and prescribes handling requirements, ensuring appropriate protection measures are applied. Data retention and secure disposal Formal procedures govern how long customer data is retained and define secure purge methods, including the ability to delete data upon customer request. Production-only customer data handling Policies strictly prohibit storing or using customer information in non-production environments, reducing exposure during development and testing activities. Security monitoring and logging Automated tools continuously watch for suspicious activity, generate real-time alerts and provide visibility into system performance and threats. Centralized log management with alerting A dedicated log analytics platform aggregates security events across the environment and instantly notifies responders of anomalies that could impact confidentiality, integrity or availability. Network intrusion detection system An IDS continuously analyzes network traffic and triggers alerts when indicators of compromise or malicious behavior are detected, enabling rapid response. System performance and availability monitoring Automated monitoring tracks key health and capacity metrics, sending notifications when predefined thresholds are exceeded to prevent service disruption. Anti-malware protection Up-to-date endpoint security is deployed on production servers to detect and block malware, with routine signature updates and logging for auditing purposes. Targeted security alert routing Critical security events are automatically correlated and delivered to personnel with the authority and context to investigate or escalate, shortening response times. Vulnerability management Structured identification, assessment and remediation processes keep systems resilient against emerging threats. Documented vulnerability management policy Formal guidelines define how vulnerabilities are discovered, ranked by severity and remediated within set timelines, aligning practices with industry expectations. Quarterly web application scanning Automated scans run every quarter to detect and prioritize web application weaknesses, ensuring issues are found before adversaries exploit them. Annual penetration testing Independent security experts conduct comprehensive penetration tests each year to uncover exploitable weaknesses in the production environment. Timely remediation of critical findings Management mandates and tracks corrective actions for all high and critical vulnerabilities identified through scanning and testing until verified closure. Routine infrastructure patch management Operating systems and other platform components are regularly patched as part of scheduled maintenance, reducing exposure to known exploits. Incident response Prepared and tested processes ensure swift detection, containment and recovery from security events to protect customer operations. Formal incident response policy A documented framework outlines roles, communication channels and step-by-step procedures for identifying, analyzing and remediating security incidents. Incident tracking and communication All security events are logged, evaluated and communicated to affected stakeholders until full resolution, providing transparency and accountability. Annual incident response testing The incident response plan is exercised each year to validate team readiness and refine processes based on test outcomes. Post-incident reviews After significant events, cross-functional teams conduct documented retrospectives to capture root causes and implement preventative improvements. Defined recovery procedures for incidents The response program includes activities focused on restoring normal operations and safeguarding data integrity following an incident. Business continuity and disaster recovery Robust continuity planning and redundant infrastructure safeguard service availability even during unexpected disruptions. Documented BC/DR plan A comprehensive business continuity and disaster recovery strategy defines responsibilities, recovery steps and communication protocols for critical services. Annual BC/DR testing Regular exercises validate that recovery objectives can be met and that personnel understand their roles during disruptive events. Daily incremental backups Customer data is backed up every day, ensuring minimal data loss in the event restoration is required. Backup restoration verification Periodic restoration tests confirm that backups can be successfully recovered and data integrity is maintained. Multi-zone data replication Production databases are replicated across multiple availability zones, providing automatic failover capability if a primary site becomes unavailable. Change management Structured development and deployment practices ensure that system changes are controlled, tested and traceable. Documented change management policy Policies require that all system modifications follow defined processes for request, testing, review and scheduling before production release. Segregated development and production environments Code is developed and tested in isolated environments separate from production, preventing unintended impact on live services. Peer code reviews Every change undergoes peer or authorized review to validate technical correctness and alignment with security standards prior to deployment. Branch protection rules Enforced restrictions within the code repository prevent unauthorized or unreviewed commits from being merged into critical production branches. Automated configuration management A configuration management tool applies standardized system settings across environments, reducing human error and drift. Employee security Rigorous personnel practices foster a culture of security and ensure trusted handling of customer data. Pre-employment background checks All new hires undergo background screening before start date to verify trustworthiness and reduce insider risk. Security awareness training on hire New employees complete mandatory training that covers cybersecurity threats, data protection obligations and acceptable use expectations. Annual security awareness training Recurring education reinforces security best practices and keeps personnel informed about evolving threats and policies. Code of conduct acknowledgment Employees formally attest to understanding and adhering to the organization’s code of ethical behavior and information handling standards. Employee confidentiality agreements Staff sign legally binding agreements prohibiting unauthorized disclosure of proprietary or customer information, strengthening accountability. Vendor and third-party management Structured oversight of service providers mitigates supply-chain risk and assures alignment with security requirements. Vendor management policy and risk assessments Documented procedures require classification and periodic evaluation of third-party vendors based on the sensitivity of services provided. Security clauses in vendor contracts Formal agreements with critical vendors embed commitments and obligations that protect customer information and define incident notification duties. Annual review of vendor SOC reports Security and compliance attestations from critical providers are examined each year, and any exceptions are assessed for impact on the platform. Comprehensive third-party inventory An up-to-date register of all external partners enables effective tracking, monitoring and timely removal of obsolete relationships. Ongoing subservice provider monitoring Management regularly communicates with the hosting provider and reviews its controls to ensure continued alignment with contractual expectations. Risk management and governance Executive oversight and structured assessments guide control selection and ensure risks are addressed proactively. Executive risk committee oversight A cross-functional committee meets quarterly to review risk posture and oversee the effectiveness of internal controls. Documented risk management policy Formal guidelines outline how threats are identified, ranked and mitigated, aligning security priorities with business objectives. Annual enterprise risk assessment Management conducts a comprehensive evaluation each year that includes fraud considerations and drives updates to the control environment. Defined risk mitigation controls Risks identified during assessments lead to targeted manual and technical controls designed to reduce likelihood and impact. Fraud risk evaluation Risk analysis explicitly considers potential fraudulent activities to ensure safeguards address both internal and external threats. Infrastructure and network security Architectural safeguards and cloud controls protect the production environment against unauthorized access and service disruption. Network segmentation Production networks are logically separated to restrict lateral movement and limit exposure of sensitive customer data. Managed security groups Firewall-like rules at the cloud perimeter enforce least-privilege ingress and egress, blocking unauthorized traffic to production resources. Hosting facility physical security The cloud provider restricts data-center entry to authorized personnel and maintains 24/7 surveillance, preventing unauthorized physical access. Secure asset decommissioning The hosting provider securely destroys retired hardware to ensure residual customer data cannot be recovered. Auto-scaling capacity management Dynamic scaling automatically provisions additional resources during demand spikes, maintaining performance and availability. Compliance and privacy Independent audits and documented policies demonstrate alignment with recognized standards and customer privacy commitments. SOC 2 Type II certification An accredited third-party annually attests to the design and operating effectiveness of controls across security, confidentiality and availability. Published privacy policy Customers are informed of data handling practices and commitments, supporting transparency and regulatory compliance. Alignment with trust services criteria Control framework maps directly to AICPA trust services criteria, giving customers confidence in recognized best practices. Customer-initiated data deletion Processes exist to purge customer data from the platform upon request, supporting regulatory obligations such as GDPR rights to erasure. Documentation Featured SOC 2 Type II Report Web, API, and Network Penetration Testing Report Pin Algorithmic Fairness Report (August 2026) Certifications SOC 2 Type II Report Web, API, and Network Penetration Testing Report Pin Algorithmic Fairness Report (August 2026) ESOF AppSec ADA CASA Vulnerability Assessment Report Privacy & Legal Terms of Service Liability, Cyber and E&O Insurance Certificate Privacy Policy Questionnaires PCI DSS Self-Assessment Questionnaire A and Attestation of Compliance Other IRS Form W-9 Subprocessors We define a subprocessor as any party that carries out processing activities necessary to provide services. Amazon Web Services · United States Hosts all of Pin’s data and web infrastructure United States Anthropic · United States AI and LLM models United States Cloudflare · United States Serves as a WAF, DNS, and CDN for Pin services United States Google Cloud · United States We use Google’s Generative AI and LLM models United States Langfuse · United States To help debug AI and LLM services United States Loops · United States Product, marketing and transactional emails sent from Pin United States OpenAI · United States AI and LLM models United States OpenRouter · United States Load distribution and high availability for AI models United States PostHog · United States Product event tracking and analytics United States Retool · United States Internal customer account administration for Pin’s employees United States Sentry · United States Track and report application errors which helps us fix issues before they are reported United States Stripe · United States We utilize Stripe as our payment processor United States Opt-in Subprocessors Marketing subprocessors help provide ads and analytics and are opt-in in certain regions. These can also be blocked utilizing an ad blocker. Facebook · United States Facebook ad targeting and tracking United States Google Analytics, Google Tag Manager · United States Product event tracking and analytics United States LinkedIn · United States LinkedIn ad targeting and tracking United States Indirect Subprocessors We define indirect subprocessors as companies that do not provide services directly through our product but may contain customer data when interacting with Pin employees while providing ancillary services. Cal · United States Scheduling software with Pin employees United States Close · United States We use Close to track customer sales activity with our team United States G Suite · United States We use G Suite for customer communication United States Pylon · United States Customer support system United States Slack · United States When communicating with Pin employees via a connected Slack channel United States Zapier · United States Helps with Sales and Customer Support automations United States Optional Subprocessors We consider optional subprocessors as companies that provide services when utilizing certain features in our product but are excluded if those features are not used. Kombo · United States Provides universal ATS integrations United States Unipile · United States Provides access to various messaging services United States Updates Jul 7, 2026 Adding clarification around ATS integrations with Pin Added the following section to our Security page to clarify how ATS integrations work with Pin: Pin will conduct a two-way sync for select integrations to pull a candidate's LinkedIn URL and their ATS ID. We use this data to provide features such as: Searching Pin's database for candidates whose LinkedIn URLs match those in your ATS. All searches run against Pin's data, not your ATS data. We match one-to-one on LinkedIn URL only. We do not sync any CV or resume data from your ATS. Knowing if a candidate is already in your ATS. Learn More Feb 11, 2026 Subprocessor update We've removed Salesforce as a Indirect Subprocessor and added Close.com as its replacement. We've added Zapier as a Indirect Subprocessor which helps us manage Sales and Customer Service automation flows. Dec 1, 2025 Subprocessor update We've removed Merge as an Optional Subprocessor and added Kombo as the replacement for the Optional Subprocessor. We take security here at Pin very seriously. Here's an overview of what we do to ensure that your data is safe. Encryption All requests to Pin including interim connections within Pin's internal infrastructure is encrypted HTTPS, TLS, and/or SSL. Any connection or request using unsecured protocols, like HTTP, are redirected to its counterpart or terminated. Pin uses HSTS to let well-known browsers like Google Chrome know and enforce that our website uses HTTPS and that HTTP should be ignored. All customer data is encrypted at rest and encrypted in transit. All secret keys and customer keys (e.g. integrations) are encrypted with hardware security modules (HSM) for extra protection. Credit cards are stored and processed security with Stripe, which is PCI Level 1 compliant. Infrastructure All data is hosted in a private environment using Amazon Web Services. All public facing endpoints and IP addresses are monitored and firewalled. Access to our private environment requires two-factor authentication and is allowed only by well-known, company-issued devices. All access attempts are logged and audited in real-time. We utilize denial of service (DOS) protection and web application firewalls (WAF) to ensure our services are protected from attacks. Our infrastructure is audited automatically and patched automatically where possible. Our team follows a strict 30-day SLA policy to patch all known vulnerabilities. Inbox Access Pin uses your inbox to send and receive emails to candidates you choose to get in contact with. We require this access to know when candidates respond back to you and stop email automation. Pin only stores copies of emails with candidates that were first initiated with Pin. Pin filters emails by matching IDs in the email headers. All other emails are discarded. Pin uses your calendar to know when you are available and display your calendar in Pin's app. We also use your calendar to automatically schedule interviews with candidates when Pin's scheduling automation feature is turned on. ATS Access When enabled, Pin uses uses Kombo to facilitate communicating with your ATS. Kombo is highly regarded in the industry and has all the necessary certifications to keep your data safe. For some ATS integrations (Greenhouse, Ashby, Lever, JobAdder, Recruiterflow, Bullhorn), we connect directly. We use the same HSM encryption methods to encrypt credentials as earlier. Pin uses your ATS to know if you've reached out to a candidate in the past and also sync candidates sourced with Pin back to your ATS. Pin will conduct a two-way sync for select integrations to pull a candidate's LinkedIn URL and their ATS ID. We use this data to provide features such as: Searching Pin's database for candidates whose LinkedIn URLs match those in your ATS. All searches run against Pin's data, not your ATS data. We match one-to-one on LinkedIn URL only. We do not sync any CV or resume data from your ATS. Knowing if a candidate is already in your ATS. Internal Policies All employee accounts are protected using 2FA. We utilize a password manager to secure online accounts and share across team members. We go through annual security testing with our partners. Including an annual review with Google's restricted scopes to use the Gmail API. We are SOC 2 Type 2 compliant. All employees and contracts sign a non-disclosure agreement. You can obtain a copy of all of our reports under the Documentation tab on this page. Bounty Program We ask that all security researches report security exploits to engineering@pin.com. Reports will be answered within 5 business days. We currently do not issue rewards at this time but we'll be more than happy to advertise your name on this page. We ask that you do not send reports for the following: DOS; Automated scripts; Mix-content scripts; Social engineering; Regular bugs; Email flooding; Input; Or not adhering to "best practices" When submitting a report, reproducable step-by-step instructions and/or video would be greatly appreciated. Subprocessors Subprocessors | Pin Trust Center | Powered by Wolfia