Security
Your money, kept apart and signed for.
Pinnacle holds US payroll-sized balances for 2,300 companies. Here is where that money sits, who can move it, and how every movement is written down.
Every dollar kept apart, every run signed for.
Safeguards in three layers: where the money sits, who can move it, and the record of every time someone did.
Approval policy
Payouts ••2290
-
Under $25,000
1 approver
-
$25,000 to $250,000
2 approvers
-
Over $250,000
2 approvers + key
-
New bank details
Held for review
Changed by Priya Raman · Sep 3, 2026 · approved by Dev Okonkwo
Where the money sits
Held for your benefit at two partner banks
Your balance sits in FDIC-insured accounts at two partner banks, titled for your benefit and kept apart from Pinnacle’s own money.
Never lent, never invested by us
We do not lend your balance, invest it or sweep it into anything you did not set up. Interest on Treasury accounts is yours.
Pass-through FDIC coverage
Insured up to $250,000 per partner bank if a partner bank fails. Larger balances can be spread across both banks automatically.
Who can move it
Roles that match the job
Admins, approvers, preparers and viewers each see only what they need. Nobody at Pinnacle can create or approve a run for you.
Security keys for the large runs
Above your limit, a run needs a second person and a tapped hardware key, which a look-alike sign-in page cannot capture.
Bank detail changes wait
A contractor’s new account is held for review by someone who didn’t make the change, and the contractor is told at their old address.
The record
An audit log you can export
Every sign-in, edit, approval and payout is logged with the person, the device and the key, kept seven years and exported to CSV.
Encrypted everywhere
Account numbers and TINs are encrypted at rest with keys held in a hardware security module, and only the last four digits are ever shown.
Checked by people who are not us.
Every report below is current, and every one is yours to read. Ask and we send it the same business day under a standard mutual NDA.
-
SOC 2 Type II
Security, availability and confidentiality controls across the platform, tested over twelve months.
Apr 2026
Request it -
Penetration test
An outside firm’s attempt on the dashboard, the API and the contractor onboarding flow.
Jul 2026
Request it -
Nacha rules audit
Our handling of every ACH file against the network’s operating rules.
Mar 2026
Request it -
Partner bank reviews
Each partner bank’s own annual review of our compliance and fraud programs.
Feb 2026
Request it
Found something?
Write to [email protected]. We answer every report within one business day and never take action against good-faith research.
Report a vulnerabilityQuestions security teams ask.
Anything else goes to our security team at [email protected]. A person answers within one business day.
Email the security teamWho can see our contractors’ bank details?
Only people you give the Payouts admin role, and only the last four digits. Full account numbers are encrypted and never shown in the dashboard, exports or support tools.
Can a Pinnacle employee move our money?
No. Every run is approved by people on your team, and runs over your limit need a second approver with a security key. Pinnacle staff cannot create or approve a run.
How do we get the SOC 2 report?
Request it from the security page or your account manager. We send it the same business day under a standard mutual NDA.
What happens to our funds if Pinnacle shuts down?
They are held for your benefit at our partner banks, not on Pinnacle’s balance sheet, so they are returned to you directly by the bank.
Put your treasury somewhere boring.
Open an account, set your approval limits on day one, and register a security key for everyone who signs. The rest of the safeguards are already on.