A product whose job is reducing your exposure has no business creating new exposure. Security decisions at Access Pilot follow three principles: hold less, verify always, and make every action auditable.
Data protection
- Encryption in transit — all traffic is served over TLS.
- Encryption at rest — email-derived records are sealed with AES-256-GCM before they touch storage.
- Minimization by design — scans process your mailbox locally; only sanitized excerpts are ever sent for AI classification, and the Settings privacy report accounts for every one of them.
Application security
- Sessions are verified server-side on every request — tokens are revalidated against the authentication service, never trusted from cookie data alone.
- Database access is governed by row-level security: every table is scoped so a user can only ever read their own rows.
- Outbound unsubscribe targets are validated before anything is sent — scheme, host and redirect chain — and the master switch for outbound actions ships off by default.
- Protected sender categories (banks, healthcare, employers, government, security notices) are excluded from automation at the policy layer, beneath any user-written rule.
Operational practice
- Least-privilege credentials, rotated and never in client code.
- Infrastructure hosted on SOC 2–audited providers (Vercel, Supabase).
- Every automated action produces a receipt: what ran, against which target, and its outcome.
Responsible disclosure
If you believe you have found a vulnerability, we want to hear about it. Email security@accesspilot.com with steps to reproduce. We commit to acknowledging reports within two business days, and we will not pursue action against good-faith research that respects user data and service availability.
Curious what data handling looks like from your side of the product? The Privacy Policy covers what is collected and how to erase it — and your own Settings page shows a per-scan accounting of everything that ever left your machine.