Security
How Question Pilot Handles Deal Data.
The tracker holds the Q&A, never the documents. What we store, who processes it, and what leaves the platform, laid out in one place.
Architecture
Less to secure, by design.
Question Pilot is scoped to the Q&A around your deal. The most sensitive material never enters the platform, and what does enter is partitioned by party.
-
No deal documents stored.
Files stay in your VDR. Question Pilot holds the questions, owners, answers, and history around them, so the tracker never becomes a second copy of the data room.
-
Isolated counterparty portals.
Each counterparty signs into its own portal and sees only the questions and answers you publish to it. No shared lists, no cross-party visibility.
-
Draft and publish control.
Client input and advisor review stay private to the deal team until an answer is explicitly posted. Nothing is shared by default.
-
A record that builds itself.
Who asked, who answered, and when stays attached to every question through close, ready to export when the deal wraps.
Data handling
What we store, and how it is protected.
- Encryption in transit
- All traffic between your browser and the platform runs over SSL/TLS encrypted connections.
- Row-level security
- Access rules are enforced on every database table, not just in the application layer, so a signed-in user can only reach the rows their role permits.
- Ownership
- Deal data remains the sole property of the subscribing firm at all times. We do not access, view, or use it except to provide the platform or as required by law.
- Retention and deletion
- Data is retained for the duration of the workspace's access period, held for up to 90 days in backups after termination, then permanently deleted. Deletion can be requested at any time.
- Cookies
- Session authentication only. No advertising cookies, no tracking cookies, no third-party analytics.
- The company
- Question Pilot is a product of Question Pilot LLC, built by deal advisors. Formal notices and requests run through the contact channel.
Subprocessors
Every provider that touches platform data, and the slice it processes. Each is bound by confidentiality obligations consistent with our Privacy Policy.
| Provider | Purpose | Data processed |
|---|---|---|
| Supabase, Inc. | Database infrastructure, authentication, and file storage | All user and deal data |
| Netlify, Inc. | Web application hosting and CDN | Web traffic logs, IP addresses |
| Stripe, Inc. | Payment processing | Payment card data, transaction records |
| Resend | Transactional email delivery | Email addresses, email content |
| Anthropic, PBC | Column mapping during import | Column headers and truncated sample cell values only |
| Microsoft Corporation | Business email services | Support correspondence |
We do not sell, rent, or lease customer data to third parties.
Import assistance
Question import sees structure, not substance.
When you import a question list, an AI service helps map the columns in your spreadsheet. Its view is deliberately narrow, and it is a mapping aid only: every suggestion is reviewed and confirmed by you before anything is imported.
-
Sent
Column headers and a structural sample.
Header names plus up to three sample rows, each cell truncated to 30 characters. Enough to identify structure, nothing more.
-
Never sent
Anything that identifies the transaction.
Deal names, project codes, counterparty names, full question text, responses, and internal notes never leave the platform.
-
No training
Deal data never trains a model.
We do not use your deal data to train AI models, and we contractually require the same of our provider. If the service is unavailable, import falls back to rule-based detection.
The full commitments are written into the AI Terms of Use.
The record
The record is ready when the deal is.
Every question carries its owner, status, posted answer, and timestamps. At close, the full tracker exports as an Excel workbook and summary tables export as CSV.
To see what that record looks like without creating an account, download a sample prepared from the staged demo workspace.
PDF rendering of the demo workspace's Q&A record. Demo data only. In the product, exports download as Excel and CSV.
Inspect it from the inside.
Open the demo workspace and check the portals, publish controls, and record against your own bar.
Security questions before you start a deal? Write us at Email Question Pilot.