Security

Our security practices

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Passwords are hashed using bcrypt via Supabase Auth. We never store plain-text passwords.
• Authentication uses JWT tokens with short expiry windows.
• Row-Level Security (RLS) is enabled on all database tables — users can only access their own data.
• Payment processing is handled entirely by Dodo Payments. We never receive or store card numbers.
• Admin access to the database requires multi-factor authentication.

Responsible disclosure

If you discover a security vulnerability, please email support@pinnacle-prep.org with the subject line "Security Disclosure". We will acknowledge your report within 48 hours and aim to resolve critical issues within 7 days. Please do not publicly disclose vulnerabilities before we have had a chance to address them.

Infrastructure

• Database: Supabase (hosted on AWS, EU region)
• Frontend: Netlify CDN
• API functions: Supabase Edge Functions (Deno runtime)

Related policies

This page covers how student data is protected technically. For what data is collected and why, see our Privacy Policy. For subscription and billing terms, see our Terms of Service.

Contact

Pinnacle Prep · Johannesburg, South Africa
support@pinnacle-prep.org

Pinnacle is not affiliated with, endorsed by, or connected to CFA Institute, GARP, the Association of Chartered Certified Accountants, or any US state board of accountancy.