Security

Pivotal Insights is a web application. Nothing is installed on user computers. Client data is stored in a managed PostgreSQL database in Amazon Web Services data centers in the United States.

Dynamics GP clients run a small agent next to their SQL Server. It makes outbound HTTPS connections only, so no firewall ports are opened to the internet.

Every table that holds client data carries a client identifier, and the database itself enforces separation with row-level security. Each read and each write is checked against the signed-in person's access before any data is returned or changed.

Our staff can see which clients exist and which modules they have licensed. They cannot see a client's financial data unless that client adds them as a user.

• Roles: owner, admin, planner, approver and viewer
• Users can be limited to certain departments or branches, in every screen and report
• Names and pay on the workforce roster are visible only to people with HR access
• Page-level access to narrow any role further
• Submissions, approvals and send-backs are recorded with the person, the time and the note

Users sign in with a one-time link or code sent to their work email, so there are no Pivotal Insights passwords to steal or reuse. Single sign-on with Microsoft Entra ID is available for clients that require it.

Passwords, client secrets and tokens for ERP connections are kept in an encrypted vault. Once entered, a secret cannot be read back through the application.

Each connection uses a dedicated API user created by the client, with read access to the general ledger and write access only to the budget Pivotal Insights uses. Budgets are written back only when an owner or admin sends an approved version.

All traffic is encrypted with TLS. Stored data is encrypted at rest, and connection secrets are encrypted again in the vault. Excel and PDF exports are created in the browser and are not kept on our servers.

The database is backed up daily. At the end of a subscription we provide an export of the client's data on request and then delete it.

AI requests send only the figures needed for the task and follow the user's own access. They go to Anthropic's Claude through our servers, and under Anthropic's commercial terms that data is not used to train its models. AI results are drafts until a person saves them, and a client admin can switch AI off.

Our hosting and AI providers maintain SOC 2 Type II reports. We are glad to share our full security overview and complete your security questionnaire. Write to info@pivotalridge.com.