Security and privacy at Pinnacle

Pinnacle is SOC 2 compliant. Pascal, the AI coach by Pinnacle, encrypts data in transit and at rest and stores it per user. Each person's coaching conversations with Pascal stay private. HR and executives see aggregated, anonymized insights, and only for groups large enough to protect anonymity. Companies set retention windows, and anyone can remove Pascal from a meeting.

Compliance

Pinnacle is SOC 2 compliant. Pinnacle is also GDPR and CCPA aligned.

For a formal review, the Pinnacle Trust Center holds Pinnacle's security documentation and the current list of subprocessors. Pinnacle has a full security, privacy and legal documentation pack and sends it early in a review. Ask at hey@heypinnacle.com. You can also read the Pinnacle privacy policy.

Coaching stays private

Each person's coaching conversations with Pascal stay private. HR and executives see aggregated, anonymized insights, and only for groups large enough to protect anonymity.

Managers can't access their reports' data.

Your data and AI training

"We don't train on any of your data, and neither do any of our LLM partners."

• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Each customer's data sits in its own isolated environment, so one customer's data can't be read or surfaced in another's.
• Within a company, data is stored per user, so nothing leaks between accounts.
• Pascal keeps text transcripts only. No audio or video is ever stored.
• Pinnacle customizes, personalizes and adapts Pascal using the company's values, frameworks, competencies, policies and documents. Where there is no connector, that context can come in through uploads or custom exports.

Retention you control

Companies set retention windows for chat transcripts, memories, insights and uploaded documents. Zero-day retention on transcripts is available: Pascal keeps the insights and deletes the transcript. Some third-party providers default to 7 days, and that can be adjusted.

Access and testing

• Administrative access requires multi-factor authentication (MFA), with role-based access controls.
• Enterprise single sign-on and SCIM provisioning are supported through SAML 2.0.
• Pinnacle conducts regular penetration tests.
• Pascal undergoes an annual independent bias audit.

Consent in every meeting

• Pascal sends a consent message when it joins a meeting.
• Anyone in the meeting can type "Pascal remove". Pascal leaves and that conversation is deleted.
• "Pascal pause" and "Pascal resume" stop and restart transcription, and a pause covers the whole meeting.
• Admins can exclude whole groups, such as a legal team.

Guardrails

If someone raises harm to themselves or others, Pascal points them to resources and flags the situation. On sensitive employee topics such as medical issues, grievances or terminations, Pascal helps the person prepare and recommends they bring in HR. Companies can set topics Pascal will not respond to.

FAQ

Is Pinnacle SOC 2 compliant?

Pinnacle is SOC 2 compliant. Security documentation is available through the Pinnacle Trust Center.

Does Pinnacle train AI models on our data?

No. We don't train on any of your data, and neither do any of our LLM partners.

Can HR or a manager read someone's conversations with Pascal?

No. Each person's coaching conversations with Pascal stay private. HR and executives see aggregated, anonymized insights, and only for groups large enough to protect anonymity.

Can we control how long Pascal keeps data?

Yes. Companies set retention windows for chat transcripts, memories, insights and uploaded documents, including zero-day retention on transcripts.

Does Pascal store audio or video from meetings?

No. Pascal keeps text transcripts only. No audio or video is ever stored.

How do people in a meeting stay in control?

Pascal sends a consent message when it joins. Anyone can type "Pascal remove" to make it leave and delete that conversation, or "Pascal pause" to stop transcription for the whole meeting.

‍