Privacy Policy

Who we are

AuditPilot (operated by PilotSuite LLC) is a compliance readiness platform for clinics and the managed service providers that support them. This policy explains what we collect, why, and the choices you have. Questions? Email hello@auditpilot.so.

What we collect

• Account information — your name, email address, and role, provided when you or your organization creates an account.
• Workspace content — the compliance data your organization puts into AuditPilot: control statuses, evidence files, vendor and BAA records, training assignments, policies, incidents, and risk entries. Your organization controls this content; we process it to provide the service.
• Integration data — when your admin connects an integration (such as Microsoft 365), we read the specific, read-only signals needed for compliance checks (e.g., MFA posture, device encryption status). You can disconnect at any time.
• Usage and log data — standard operational logs (IP address, browser, pages viewed, actions taken) used for security, audit trails, and troubleshooting.

How we use it

• To provide, secure, and improve the service.
• To send transactional email (invites, training assignments, alerts).
• To maintain audit logs your organization relies on for compliance.
• To respond to support requests.

We do not sell your personal information, and we do not use your workspace content to train AI models.

Protected health information

AuditPilot is designed to hold compliance evidence, not patient charts. Where evidence may contain PHI, we act as a business associate and will sign a Business Associate Agreement with covered entities. See our Security page for how files are stored, scanned, and access-controlled.

Sharing

We share data only with the subprocessors that run the service (hosting, database, authentication, email, billing, malware scanning, and AI processing — listed on our Security page), with your organization's administrators, with people you explicitly share access with (such as an auditor via a share link), and where required by law.

Retention and deletion

Workspace content is retained while your organization's account is active. When a workspace is deleted, its content — including uploaded files — is removed from production systems. You may request deletion of your personal data by emailing hello@auditpilot.so.

Your choices

• Access, correct, or delete your account information.
• Disconnect integrations at any time from Settings.
• Revoke auditor and training share links at any time.

Changes

If we make material changes to this policy, we'll notify workspace owners by email and update the effective date above.