Data Processing Addendum

Last updated: July 24, 2026

This Data Processing Addendum describes how LinearPilot processes the personal data your company entrusts to it, the sub-processors involved, and the security terms LinearPilot offers. It is written to help procurement, security, and compliance teams evaluate LinearPilot.

Roles of the parties

For the personal data your company processes through LinearPilot, your company is the controller (or, under US state privacy laws, the business) and LinearPilot is the processor (or service provider). LinearPilot processes that data only to provide the service on your documented instructions, and does not sell it or use it for its own purposes.

Sub-processors

LinearPilot uses two AI sub-processors: Google (Gemini API) for search indexing, AI chat, document understanding, voice transcription, and image generation, and Anthropic (Claude API) for AI chat on the highest model tier. Both process customer data under API terms that exclude it from training their models, and LinearPilot enables no setting that would allow such training. The maintained, dated list of sub-processors — with the exact data each receives and its processing region — is published on the sub-processors page.

Categories of data processed

Depending on which apps your company uses, LinearPilot processes the business records you store in it — including CRM contacts and deals, mail, calendar events, and the files and documents you upload — together with the account and usage data needed to operate the service.

When your company enables external AI features, the following categories may be sent to the AI sub-processors named above to produce a result you requested:

• The prompts you type and the context LinearPilot includes to answer them
• Document and embedding text that LinearPilot indexes or analyses
• The voice you record for dictation
• The rows of the datasets and files that code execution processes for you
• Images and scanned documents processed by OCR and vision
• The prompts you write to generate images

Security measures

LinearPilot applies the following technical and organisational measures to protect customer data:

• Encryption of data in transit and at rest
• Role- and record-level access controls, so each user reaches only the data they are permitted to see
• Masking of personal and sensitive fields before any content is sent to an external AI provider
• External AI processing is off until your company explicitly enables it; while it is off, no customer content is sent to an AI sub-processor
• An optional on-premises file connector, so your company can keep its files on its own storage rather than uploading them to LinearPilot

Sub-processor change notice

LinearPilot publishes any change to its sub-processor list on the sub-processors page before the new sub-processor begins processing customer data, so your company has the chance to review it.

Assistance with data-subject rights

LinearPilot provides tools and, where needed, reasonable assistance to help your company respond to requests from its data subjects — including access, correction, deletion, and export — as required by applicable privacy law.

Return and deletion on termination

On termination, your company can export its data, and LinearPilot deletes or returns customer data on request, subject to any retention required by law. AI sub-processors do not retain customer content for training under their API terms.

Breach notification

If LinearPilot becomes aware of a personal-data breach affecting your company's data, it will notify your company without undue delay and share the information reasonably available to support your own notification obligations.

Certifications

LinearPilot does not currently claim SOC 2, ISO 27001, or HIPAA certification, and does not represent that a Business Associate Agreement is already in place. Where a signed DPA or a BAA is required, one is available on request via the contact below. This page states only what is true today; we will update it as our compliance posture changes.

Request a signed DPA or BAA

To request a countersigned DPA or a BAA, or to ask how your data is processed, contact us at [email protected]. Please include your company name and the agreement you need.