A plain list of the controls built into ShiftPilot AI today, and what is still being built. ShiftPilot AI holds no security certification, and this page is not one. Dealerships should complete their own legal, security and penetration-test reviews.
Users can enroll an authenticator app. Sensitive areas require a verified second factor for the current session before they open.
Sensitive actions — role changes, exports, integration changes, deal and finance updates, MFA events — are written to an audit log that regular users cannot edit.
Access is granted per dealership by role (dealer principal, managers, sales, finance, service, accounting, read-only). Pages and actions check the role before opening.
Each dealership's records are isolated in the database with row-level security, so users only read and write rows for dealerships they belong to (platform staff access is role-gated and audited).
AI proposes; people decide. Customer messages and other high-risk AI actions wait for a person to approve before anything is sent or changed.
Data exports are limited to authorized roles, require a verified second factor, and are recorded in the audit log.
Provider keys and service credentials stay on the server and are never sent to the browser.
Single sign-on with your identity provider and automatic user provisioning are being built. Not available yet.
No SOC 2 report exists today. ShiftPilot AI does not claim SOC 2 or any other certification.
A public uptime and incident page is planned. Not available yet.
An independent penetration test has not been completed yet. Results will be summarized here once available.
The Privacy Policy and Terms are being reviewed by counsel. Not final yet.
Self-serve export of audit events for your own records is being built. Not available yet.
The list of third-party services that process customer data is being finalized and will be published here.
The formal retention schedule and deletion process are being finalized and will be published here.
Security disclosures: security@shiftpilotai.io · General trust questions: trust@shiftpilotai.io