Data Processing Addendum

Last updated: October 17, 2026

This Data Processing Addendum describes how LinearPilot processes the personal data your company entrusts to it, the sub-processors involved, and the security terms LinearPilot offers. It is written to help procurement, security, and compliance teams evaluate LinearPilot.

Roles of the parties

For the personal data your company processes through LinearPilot, your company is the controller (or, under US state privacy laws, the business) and LinearPilot is the processor (or service provider). LinearPilot processes that data only to provide the service on your documented instructions, and does not sell it or use it for its own purposes.

Sub-processors

LinearPilot uses sub-processors to run the service: external AI providers where your company has enabled AI features, and operational providers such as payment processing. Every AI provider processes customer data under API terms that exclude it from training their models, and LinearPilot enables no setting that would allow such training. This addendum deliberately does not repeat the roster — a copy here falls out of date the moment the register changes. The maintained, dated register, with each provider's purpose, the exact data it receives, and its processing region, is published on the sub-processors page.

Categories of data processed

Depending on which apps your company uses, LinearPilot processes the business records you store in it — including CRM contacts and deals, mail, calendar events, and the files and documents you upload — together with the account and usage data needed to operate the service.

When your company enables external AI features, the following categories may be sent to the AI providers on that list to produce a result you requested:

• The prompts you type and the context LinearPilot includes to answer them
• Document and embedding text that LinearPilot indexes or analyses
• The voice you record for dictation
• The audio of a meeting you record and the transcript made from it
• The rows of the datasets and files that code execution processes for you
• Images and scanned documents processed by OCR and vision
• The prompts you write to generate images

Security measures

LinearPilot applies the following technical and organisational measures to protect customer data:

• Data is encrypted in transit and stored on encrypted storage at rest; credentials, tokens and tax identifiers carry an additional layer of encryption applied by LinearPilot
• Role- and record-level access controls, so each user reaches only the data they are permitted to see
• Masking of personal and sensitive fields before the assistant sends text to an external AI provider
• Per-user consent for the assistant, off until each person grants it, with the external provider withheld until they do. Document indexing is not gated on it.
• Masking is the weakest posture available for external AI, not a setting that can be switched off; an administrator can tighten it further, up to keeping documents and records out of external processing entirely
• An optional on-premises file connector, so your company can keep its files on its own storage rather than uploading them to LinearPilot, unless an administrator chooses to mirror them here; where assistant reading is on, the text of those files is extracted, stored and sent to an external AI provider so they can be searched

Sub-processor change notice

LinearPilot publishes any change to its sub-processor list on the sub-processors page before the new sub-processor begins processing customer data, so your company has the chance to review it.

Assistance with data-subject rights

LinearPilot provides tools and, where needed, reasonable assistance to help your company respond to requests from its data subjects — including access, correction, deletion, and export — as required by applicable privacy law.

Return and deletion on termination

On termination, your company can export its data, and LinearPilot deletes or returns customer data on request, subject to any retention required by law. AI sub-processors do not retain customer content for training under their API terms.

Breach notification

If LinearPilot becomes aware of a personal-data breach affecting your company's data, it will notify your company without undue delay and share the information reasonably available to support your own notification obligations.

Certifications

LinearPilot does not currently claim SOC 2, ISO 27001, or HIPAA certification, and does not represent that a Business Associate Agreement is already in place. Where a signed DPA or a BAA is required, one is available on request via the contact below. This page states only what is true today; we will update it as our compliance posture changes.

Request a signed DPA or BAA

To request a countersigned DPA or a BAA, or to ask how your data is processed, contact us at [email protected]. Please include your company name and the agreement you need.