# Privacy at DraftPilot

How DraftPilot handles your contracts, playbooks and personal data, where it is stored, and how to reach us about privacy.

This page summarizes how DraftPilot handles your data. Our [Privacy Policy](/privacy-policy) is the binding document, and our [Terms and Conditions](/terms-and-conditions) govern use of the service. If anything here differs from the Privacy Policy, the Privacy Policy applies.

## Who we are

DraftPilot is operated by DraftPilot Ltd, 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom. DraftPilot is an AI contract review tool that runs inside Microsoft Word for in-house legal teams.

## Your contracts

- DraftPilot does not store a copy of your contracts on its servers.
- To analyze a contract, DraftPilot sends it to OpenAI's models through the OpenAI API.
- We have agreed Zero Data Retention with OpenAI, so OpenAI deletes inputs and outputs immediately and does not keep them for abuse monitoring.
- Neither DraftPilot nor OpenAI trains AI models on your contracts or your interactions with DraftPilot.

## Your playbooks

Your playbooks are stored on our AWS servers in Ireland by default. On the Enterprise plan you can choose US-only hosting instead.

## Security

- DraftPilot is SOC 2 Type II and ISO 27001 certified, and is GDPR compliant.
- Data is encrypted at rest with AES-256 and in transit with TLS 1.2.
- Our [Trust Center](https://draftpilot-ltd.trust.site/) lists our security controls. You can request our SOC 2 report, ISO 27001 certificate and Data Processing Agreement there. See [Requesting security documents from the Trust Center](/knowledge-base/requesting-security-documents-from-the-trust-center).

## AI assistants connected to DraftPilot

If you connect an AI assistant to DraftPilot through our [MCP server](/mcp), you sign in and approve the connection yourself. The assistant can only reach what your DraftPilot account can access, within the scopes you approved. You can revoke the connection at any time from **MCP connections** in DraftPilot. Revoking does not remove content already retrieved into a conversation with that assistant.

## Contact us about privacy

For privacy questions or to exercise your data protection rights, email [contact@draftpilot.ai](mailto:contact@draftpilot.ai) or use our [contact page](/contact).