Security

Pirouette holds CVs, career histories and candid answers about people's working lives. That is sensitive material, and this page is how we account for looking after it, written for someone reviewing us on behalf of an organisation. It includes what we do not have yet, because a security page without that section is a brochure.

How the product is put together

Pirouette is a single web application hosted on Vercel, with one Postgres database, authentication and file storage provided by Supabase in Zurich. Guidance is generated by Anthropic's models. There are no other moving parts, and every company involved is listed below.

Who else touches your data

Five companies handle personal data on our behalf, and there are no others:

• Supabase: database, sign-in, and file storage.
• Anthropic: generates your skills profile and pivot scenarios.
• Vercel: hosting, request routing, and cookieless analytics.
• Google: delivers our outbound email, and lets a coach connect their calendar so you can see real availability.
• ImprovMX: forwards mail sent to our @mypirouette.co addresses to our inbox.

Where each one runs, what it touches and the safeguard covering any transfer are set out on our privacy page. If you are evaluating us for an organisation and need the full annex, with data categories and transfer mechanisms per company, ask and we will send it.

Keeping one member's data away from another's

This is the question that matters most, so here is the evidence rather than the assurance. Every table is protected by row level security in the database itself, not by application code that could forget to check. We verify it by probing all 44 externally reachable tables with three different identities:

• An anonymous visitor holding the public key returns zero rows on every single table.
• A signed-in member returns their own rows and nothing else: their profile, their assessment, their conversation, their activity. The only tables that return more are reference data and shared content, by design.
• Sensitive columns are granted individually rather than by default. A coach's calendar tokens, for example, cannot be read by any signed-in identity at all.

That probe is a script we re-run and date, so the answer is current rather than remembered. We will share the dated output with an organisation evaluating us.

Encryption

Everything travels over TLS and is stored encrypted at rest. Uploaded documents live in private storage that is not reachable by URL. Our production site sends HTTP Strict Transport Security, so a browser that has visited once will refuse to connect insecurely afterwards, along with the frame, content type, referrer and permissions headers that limit what a page can be made to do.

Who can reach production, and how

• Access to production data is limited to the two founders. There are no other staff, contractors or support agents.
• Multi-factor authentication is enabled on every administrative console we use, with recovery codes held off-device.
• Open registration is disabled at the authentication provider, so accounts exist only where we created them or a person came through our own sign-up.
• Sensitive actions against an account are written to a security log that records what happened and when.

What the AI sees, and what it does not

Your CV text and your Skills Mirror conversation go to Anthropic to generate your own guidance, and nowhere else. Anthropic does not train its models on it and deletes it within 30 days. No model is trained on member data by us or by anyone on our behalf.

We also use AI agents internally to help run the business. They work on operational data: counts, timings, the state of our own task board, and the feedback members choose to send us. They are not used on CVs, uploaded files or Skills Mirror conversations, and none of them can send email to a member, which requires a founder.

Availability and recovery

An uptime check runs from infrastructure independent of the platform it monitors, so an outage cannot suppress its own alarm, and it emails both founders on repeated failure.

We are moving our database to a plan that provides daily backups and point-in-time recovery. Until that is in place we do not offer a recovery time or recovery point commitment, and we would rather say so than imply one.

Reporting a vulnerability

If you believe you have found a security problem, email security@mypirouette.co. We will acknowledge within two working days. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before going public.