Security

Our approach

Otto Pilot handles pipeline data your business depends on. We keep the surface area small: least-privilege access, encrypted everywhere, and no data collected that the product does not need.

Infrastructure

• Hosted on managed cloud infrastructure with our database and serverless functions on Supabase (SOC 2 Type II audited infrastructure).
• All traffic is encrypted in transit with TLS 1.2+; data is encrypted at rest.
• Secrets and API keys are stored server-side only and never shipped to the browser.

Access control

• Workspace data is isolated per customer and protected with row-level security.
• Integration connections use OAuth where the provider supports it; you can revoke any connection at any time and we drop the tokens.
• Internal access to production is limited to the founders, logged, and used only for support you request.

AI data handling

• Requests to AI model providers carry only the data needed for the task you asked for.
• Your private workspace data is not used to train models for other customers.

Subprocessors

These are the service providers that process data for Otto Pilot. We will update this list as it changes.

• Cloudflare: hosting and website analytics.
• Supabase: database and serverless functions.
• Stripe: billing and payments.
• Twilio: calls and call recordings.
• AI model providers: the models behind Otto, scoring, drafting and call summaries.
• Cal.com: scheduling.
• Our email delivery provider: The Signal and the emails we send you.
• Our connection provider for LinkedIn, WhatsApp and Instagram: keeps the accounts you connect in sync with Otto.
• The CRMs you connect: the records you choose to sync.

Reporting a vulnerability

Found something? Email hello@otto-pilot.io with details. We read every report and respond quickly.