Privacy and security practices
Described as implemented. RevenuePilot does not claim third-party certifications.
Organization isolation
Every tenant-owned table carries an organization id and is protected by Postgres Row Level Security. Organization is derived from your session, never from client input.
Role-based permissions
Seven roles control who can import, verify, approve and execute. A read-only executive cannot execute actions or change discount rules.
Secrets stay on the server
Gemini, service-role and integration credentials are never sent to the browser.
AI boundaries
The model has no database or shell access. Financial amounts are computed by deterministic code. Uploaded text is treated as untrusted data and AI output cannot authorize any action.
Private documents
Uploaded contracts are stored in a private bucket scoped by organization.
Audit trail
Status changes, approvals, executions and recovery events are recorded with the acting user.
Deletion
Owners can delete an organization and its data, and administrators can revoke member access.