Security & compliance at PiPilot
PiPilot is built so your work stays yours. Your projects live in your own Google Drive, our infrastructure is independently audited, and we hold as little of your data as possible. This page is our single source of truth for how we secure the platform.
Independently audited by Atom Assurances LLC · Wyoming CPA FirmCertifications & compliance
SOC 2 Type II
Report available on requestControls for security, availability and confidentiality, audited over a monitoring period.
SOC 2 Type I
Report available on requestPoint-in-time attestation that our security controls are suitably designed.
GDPR
CompliantEU data-protection principles: lawful basis, data-subject rights, data minimization and cross-border safeguards.
HIPAA
AlignedAdministrative, physical and technical safeguards aligned with the HIPAA Security Rule.
How we protect your data
Encryption in transit
All traffic is served over TLS. Credentials and tokens are never exposed in URLs.
Your code stays in your Drive
Project files are stored in your own Google Drive, not on our servers — data minimization by design.
Row-level security
Our Postgres uses row-level security so tenants can never read each other’s data; sensitive tables are locked to service roles.
Scoped credentials
Integration tokens you connect are stored encrypted and used only to perform the actions you request.
Authenticated APIs & rate limiting
Every privileged endpoint verifies a real JWT and is rate-limited per IP and per day to resist abuse.
No training on your content
We never use your private prompts or project content to train foundation models.
Subprocessors
| Provider | Category | Location | Purpose |
|---|---|---|---|
| Vercel | Hosting & CDN | USA | Global delivery of PiPilot and published sites. |
| Supabase | Database & Auth | USA | Application database, authentication and backend. |
| E2B | Compute | USA | Secure cloud sandboxes for builds, previews and Missions. |
| Storage & Sign-in | USA | Google sign-in and Drive storage for your projects. | |
| Stripe | Payments | USA | Subscription billing and payment processing. |
| Zoho Mail | USA / India | Transactional email (sign-in, invites, notifications). | |
| Anthropic | AI inference | USA | AI models behind the build agent (via our gateway). |
| xAI | AI inference | USA | AI models behind the build agent (via our gateway). |
Policies & documents
SOC 2 reports and our security whitepaper are available under NDA — email technical@pipilot.dev.
Frequently asked
Your project files live in your own Google Drive in an app-private folder — we do not keep copies on our servers. Account and usage metadata are stored in our Supabase database.
Contact our security team
PiPilot