Trust Center

Security & compliance at PiPilot

PiPilot is built so your work stays yours. Your projects live in your own Google Drive, our infrastructure is independently audited, and we hold as little of your data as possible. This page is our single source of truth for how we secure the platform.

pipilot · atom assurances

Independently audited by Atom Assurances LLC · Wyoming CPA Firm

01Compliance

Certifications & compliance

SOC 2 Type II
Report available on request
Controls for security, availability and confidentiality, audited over a monitoring period.
SOC 2 Type I
Report available on request
Point-in-time attestation that our security controls are suitably designed.
GDPR
Compliant
EU data-protection principles: lawful basis, data-subject rights, data minimization and cross-border safeguards.
HIPAA
Aligned
Administrative, physical and technical safeguards aligned with the HIPAA Security Rule.

02Security

How we protect your data

Encryption in transit: All traffic is served over TLS. Credentials and tokens are never exposed in URLs.
Your code stays in your Drive: Project files are stored in your own Google Drive, not on our servers — data minimization by design.
Row-level security: Our Postgres uses row-level security so tenants can never read each other’s data; sensitive tables are locked to service roles.
Scoped credentials: Integration tokens you connect are stored encrypted and used only to perform the actions you request.
Authenticated APIs & rate limiting: Every privileged endpoint verifies a real JWT and is rate-limited per IP and per day to resist abuse.
No training on your content: We never use your private prompts or project content to train foundation models.

03Subprocessors

Subprocessors

Provider	Category	Location	Purpose
Vercel	Hosting & CDN	USA	Global delivery of PiPilot and published sites.
Supabase	Database & Auth	USA	Application database, authentication and backend.
E2B	Compute	USA	Secure cloud sandboxes for builds, previews and Missions.
Google	Storage & Sign-in	USA	Google sign-in and Drive storage for your projects.
Stripe	Payments	USA	Subscription billing and payment processing.
Zoho Mail	Email	USA / India	Transactional email (sign-in, invites, notifications).
Anthropic	AI inference	USA	AI models behind the build agent (via our gateway).
xAI	AI inference	USA	AI models behind the build agent (via our gateway).

04Documents

Policies & documents

SOC 2 reports and our security whitepaper are available under NDA — email technical@pipilot.dev.

05FAQ

Frequently asked

Your project files live in your own Google Drive in an app-private folder — we do not keep copies on our servers. Account and usage metadata are stored in our Supabase database.

No. Your private prompts and project content are never used to train foundation models.

Yes — our SOC 2 Type I and Type II reports are available under NDA. Email us and we’ll share them.

Email technical@pipilot.dev with details. We investigate every report and respond promptly.

Our compliance is independently attested by Atom Assurances LLC, a Wyoming CPA firm.

06Contact