Security
Built like it holds your whole world.
Because it does.
A chief of staff sees everything — your mail, your meetings, your decisions. PILOT is engineered so that this access is safe by architecture, not by policy. Here is exactly how, with no theater.
Per-user database isolation
Your data lives in its own PostgreSQL schema — not a shared database with a row filter. No query from another tenant can touch your tables, because there are no shared tables. Isolation is structural.
AES-256 field-level encryption
Names, email content, transcripts, and decisions are encrypted at the field level with AES-256, on top of encryption at rest and in transit. Even with database access, the sensitive fields read as ciphertext.
Secrets in Azure Key Vault
API keys and tokens live in Azure Key Vault; the runtime authenticates via Managed Identity. There are no credentials sitting on disk to find.
EU data residency
Customer data is hosted on Microsoft Azure in the EU — EU data residency by default. EU-resident AI processing is available as an option. GDPR/DSGVO compliance is designed in, not bolted on.
OAuth only — no passwords
Sign-in is via Microsoft Entra ID or Google OAuth. There is no password database to breach. You connect only the accounts you choose, and you can disconnect them at any time.
True deletion, full export
DELETE means delete: removing your account drops your entire database schema — not a 90-day processing request. And you can take a complete GDPR export of your data as structured JSON whenever you want.
The write gate
PILOT proposes; you dispose. Every outbound action — an email, a meeting change, anything that leaves your world — is drafted and waits for your explicit confirmation. Reading is automated; writing never is.
Isolated by architecture
Your data lives in its own private database schema — not in shared tables filtered by a customer ID. There is no table where your rows sit next to another client's, and deleting your account drops the schema. For clients who require it, PILOT deploys as dedicated infrastructure in your own cloud — it already runs today in one client's own Azure subscription, by invitation.
What we don't claim
We hold no SOC 2 or ISO certification today, and we won't pretend otherwise. What you read on this page is the actual architecture. If your diligence process needs more detail, ask —contact@noveldo.com answers technical questions directly.