This page summarizes how DraftPilot handles your data. Our Privacy Policy is the binding document, and our Terms and Conditions govern use of the service. If anything here differs from the Privacy Policy, the Privacy Policy applies.
Who we are
DraftPilot is operated by DraftPilot Ltd, 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom. DraftPilot is an AI contract review tool that runs inside Microsoft Word for in-house legal teams.
Your contracts
- DraftPilot does not store a copy of your contracts on its servers.
- To analyze a contract, DraftPilot sends it to OpenAI’s models through the OpenAI API.
- We have agreed Zero Data Retention with OpenAI, so OpenAI deletes inputs and outputs immediately and does not keep them for abuse monitoring.
- Neither DraftPilot nor OpenAI trains AI models on your contracts or your interactions with DraftPilot.
Your playbooks
Your playbooks are stored on our AWS servers in Ireland by default. On the Enterprise plan you can choose US-only hosting instead.
Security
- DraftPilot is SOC 2 Type II and ISO 27001 certified, and is GDPR compliant.
- Data is encrypted at rest with AES-256 and in transit with TLS 1.2.
- Our Trust Center lists our security controls. You can request our SOC 2 report, ISO 27001 certificate and Data Processing Agreement there. See Requesting security documents from the Trust Center.
AI assistants connected to DraftPilot
If you connect an AI assistant to DraftPilot through our MCP server, you sign in and approve the connection yourself. The assistant can only reach what your DraftPilot account can access, within the scopes you approved. You can revoke the connection at any time from MCP connections in DraftPilot. Revoking does not remove content already retrieved into a conversation with that assistant.
Contact us about privacy
For privacy questions or to exercise your data protection rights, email [email protected] or use our contact page.