Security & Compliance
Your data, our posture
ReviewPilot AI processes the inputs you submit for analysis. This page states, plainly, what we handle and what we do not claim.
What we handle
Unified diffs, the rule focus you select, and the findings produced from them.
Data handling commitments
- Submissions run the product pipeline and are retained only as long as needed for your audit log (paid tiers) or until you delete the run.
- We apply access controls consistent with GDPR Art. 32 (security of processing) where personal data is processed.
- BYOK keys (Enterprise), when offered, are stored server-side only and never exposed to the browser.
Honesty rule: ReviewPilot AI reviews the diff you submit and reports what it finds. We do not guarantee that it finds every defect, that the rule set covers your whole codebase, or that missing findings means your change is safe.
Our compliance posture
- ReviewPilot AI is decision support, not a security certification, a penetration test, or a replacement for human review.
- For a security sign-off, rely on your own review process and qualified reviewers.
Subprocessors & payments
- Payments are processed by Waffo Pancake (merchant of record).
- See Privacy and Terms for full terms.
refs: OWASP Secure Coding Practices · CWE Top 25 · code review hygiene sources