Yes. Pistachio is ISO/IEC 27001 certified, and our compliance is subject to full external audit by an independent auditor every year. During evaluation we can provide our ISO/IEC 27001 certificate, Statement of Applicability, latest audit reports, Data Processing Agreement, and IT security assessment documentation.

All customer data is hosted in Europe on Google Cloud infrastructure in the Netherlands, and no data is transferred outside the EEA. Data is encrypted at rest, and internal access is limited to a small group of authorised individuals. For Presence, the AI models run inside Google Cloud's Vertex AI and data never leaves Google's European data centres. For UK customers, transfers from the UK to the Netherlands are lawful under the UK's adequacy regulations, covered by the standard DPA (which includes Standard Contractual Clauses).

‍

Yes. Pistachio acts as a data processor on behalf of you as the controller, processing personal data solely to deliver the product. The lawful basis is legitimate interest, balancing your interest in mitigating cyber risk against how invasive the processing is for employees. Practice only processes work-related behavioural data, not sensitive personal information. Full details are in our Privacy Notice and Data Processing Agreement.

No. Pistachio does not read email content or document content, and has no capability to do so. For Practice, we only write simulations into mailboxes. For Presence, we analyse the same audit logs your IT admin could review manually (file names and locations, email subject lines and attachment names, login events, activity patterns), never the content itself.

For Practice, data is kept for as long as you use the product and for 12 months afterwards, so you can download historical reports (for example for year-end audit) before it is securely disposed of. For Presence, audit log data is retained for 60 days; if an alert is raised about an employee, the relevant data is stored and made available to you as a CSV for as long as you use the service.

Pistachio is designed to run automatically with no configuration on your side, and the permissions exist to make that possible. Pistachio requires four permissions from your Microsoft Entra tenant, granted via the OAuth 2.0 client credentials flow: User.Read lets users log in with their Microsoft accounts and gives access to basic profile information such as name. User.Read.All lets Pistachio read profile data (name, job title, department, location, email, language, photo) for licensed users only, to personalise simulations and surface relevant information to admins. Directory.Read.All lets Pistachio read group data and basic organisational information, such as your organisation's name and preferred language. Mail.ReadWrite is required to inject phishing simulations into mailboxes. Microsoft groups read and write permissions together under this single permission; the more precise permission for what we do would be Mail.Write, and we are actively lobbying Microsoft to split them. The specific endpoint we use ("Create mail in mail folder") only writes emails, it does not read them. Pistachio does not read your emails and has no code that would allow it to. Full detail is published at pistachioapp.com/permissions.