Security isn’t a feature of GuardPilot — it’s the whole point. Here’s how we protect the data you trust us with, starting with the data we choose never to hold.
Last updated: July 17, 2026
The safest data is the data we never store. GuardPilot detects credential exposure using one-way hashes and metadata — we do not store the plaintext passwords found in breach and infostealer data, and we never ask you for your passwords. If our systems were ever compromised, there are no plaintext credentials to steal.
Our AI incident responder helps explain incidents and guide your response. We deliberately exclude passwords and credential hashes from everything we send to the AI model — it receives only the non-sensitive context needed to describe an incident and suggest next steps.
Every customer’s data is separated at the database level using row-level security. Requests are scoped to a single tenant, and the application connects with a restricted, non-privileged database role — so one customer’s data can’t be reached from another customer’s session, even in the event of an application bug.
All traffic to GuardPilot is served over HTTPS with modern TLS. Connections are automatically redirected to secure channels, and certificates are renewed on a continuous schedule.
Our application services run as unprivileged system users, connect to the database with only the permissions they need, and keep secrets (API keys, database credentials) in access-restricted configuration that is never committed to source control. Network access to the servers is firewalled to only the ports required.
Sign-in is handled by a dedicated authentication provider, and every request to your data is verified against a cryptographically signed session token. We support strong, modern authentication, and we encourage enabling multi-factor authentication on your account.
We welcome reports from security researchers. If you believe you’ve found a vulnerability in GuardPilot, please email security@guardpilot.io with the details. We’ll acknowledge your report, investigate promptly, and keep you updated. Please give us a reasonable chance to fix an issue before disclosing it publicly, and don’t access or modify data that isn’t yours while testing.
Security is never finished. We continue to harden GuardPilot as we grow. For how this connects to the data we collect and your rights over it, see our Privacy Policy.