Your costing, your clients and your guests' details are what your company is built on. So two questions matter: who can reach them, and will they still be there on the morning of a program. Explore the safeguards, privacy controls and recovery practices built into DMC Pilot.
Last reviewed
Each company's data is kept apart by row-level security in Postgres. The database itself enforces it, not the screen. Our own maintenance tools use a separate server-only role, with their own authorization checks and audit logging.
Every server action checks permissions for itself, as if it were open to the internet. Hiding a button on screen is never what keeps your data safe.
Guest names, email, phone, emergency contacts, dietary, allergy and special-requirement fields, waiver answers and accounting connection tokens are encrypted at rest. A dedicated application key is used on every write, and it can be rotated. Files are shared through signed links that expire.
There is no open sign-up to attack. We create each company account, and your administrators invite users. Invitations are single-use, stored hashed, and expire.
Two-factor sign-in with an authenticator app (TOTP) is available to every user on every plan. Enterprise adds SAML single sign-on, which you can require for everyone, and an API with scoped keys, rate limits and audit logging. The API stays off until DMC Pilot switches it on for your company.
Thirty-four permission modules, each with view, create, edit and delete, plus special permissions such as seeing every program. Six preset roles, custom roles, and freelancers limited to their own programs whatever their role. Program access follows membership: anyone else gets a 404.
The change history records who changed what, from where, on which device, and the value before and after. Sensitive values are marked as changed, never copied. Only the server writes it. Deleting an account does not erase it: the person becomes a permanent pseudonym, because a log you can clear by leaving is not a log.
Proposal and contract signatures record the signer, time, IP address, device and a SHA-256 hash of the signed document. Waiver signatures record the signer, time, IP address and device on a certificate page. Countersigned copies are kept on the same record.
Every model call is sent with data collection denied, so no provider that trains on inputs is used. Requests that could carry health data must use zero-retention endpoints, and fail rather than fall back. If one of your people connects their own AI assistant, that is a separate flow: with their consent, it receives only what that person may read, and never health data.
Seven types of data have retention periods, within limits the software enforces when data is written and read. Health, dietary and accessibility details are always cleared 30 days after a program ends. The other six are deleted once you switch enforcement on.
Each person can export or delete their own account data in Settings, with no ticket needed. The export includes location and device history. What clients see is kept to the minimum: status, not surveillance.
The company owner can download your company's records and files in one archive, from Settings, Data & Privacy. Each file in it has a checksum. Reports, CSVs, PDFs and files also download in the product, and Settings exports your own account data. The Terms set out the 60-day window after you leave, and our promise not to hold data back over a dispute.
Who can reach what
Sales sees the deals, finance sees the money, and a freelance guide sees the one program they are working on.
Continuity
Security is about who can reach your data. Continuity is about whether it is still there on the morning of a program. Daily database backups, independent encrypted recovery archives, monitoring and company exports support that continuity.
Managed Postgres with automated daily backups, kept for seven days. Restores are a platform operation to a daily snapshot, not a script someone must remember to run. We check that backups complete. Independent, age-encrypted database archives also run to a separate R2 backup bucket, with daily download and checksum checks verified on October 9, 2026. Our recovery procedures cover the database, files, service configuration and separately held recovery keys.
Production runs in the United States: the database in AWS us-east-2 (Ohio) and the app on Vercel in Cleveland. Data processing terms are available for EU customers, and personal-data export and deletion are in Settings.
The app is served from Vercel's edge network, and files from Cloudflare R2 object storage. No single server in an office holds up a program day.
Errors are monitored with Sentry and alert our team directly. The day on site is the wrong time for you to be the one who spots a fault.
The company owner can download your company's records and files in one archive, from Settings, Data & Privacy. It is prepared in the background, and the owner gets an email when it is ready. The download needs a sign-in and stays available for seven days. The export is an archive for portability, with a manifest and file checksums.
Flight data, email and payments come from separate providers. If one has a problem, your data stays readable and the rest of the program keeps running.
Your corporate clients need visibility into the people and programs they entrust to you. Client View (a live page for your client), guest updates and IROPS (where you handle flight disruptions and issues) give your client visibility and a record, built on the same isolation and audit trail. Each client sees only their own guests, and sees status, not surveillance.
In a Postgres database in AWS us-east-2 (Ohio), with row-level security keeping each company apart. Files are on Cloudflare R2 object storage, shared through signed links. Payments are processed by Stripe, and the app runs on Vercel in Cleveland. Errors are monitored with Sentry.
Only those who need to. Access to production data is restricted, actions are audited, and customer data is used only to run the service. It is never sold. Settings exports your own account data, and the company owner can download your company's records and files in one archive.
Guests, photographers and people viewing Client View use private links, with a password and the option to switch them off where it matters. Suppliers and invited client contacts sign in with a code or link sent by email, never a password, and see only their own work. No passwords means no password risk for the many outsiders a season involves.
Your data is what has to survive. It lives in managed Postgres with automated daily backups, kept for seven days, and the app is served from an edge network, not one machine. Guest links, the supplier portal and the day sheet all read from that same data. Independent encrypted database archives are stored separately and checked daily.
Yes. The company owner can download your company's records and files in one archive, from Settings, Data & Privacy. It is prepared in the background, and the owner gets an email when it is ready. The download needs a sign-in and stays available for seven days. It includes private conversations, My Files and unsent chat drafts. Passwords and access keys are never included. The export is an archive for portability, with a manifest and file checksums. Guest lists, finances, timesheets and the change history also export to CSV, reports and documents download as PDFs, and each person can export their own account data from Settings. Software you cannot leave is a risk to you, so we say exactly where the exit stands.
They are encrypted at rest under a dedicated key on every write. They are always cleared 30 days after a program ends, and left out of what the AI assistant routinely sees. They can only be opened through a specific guest lookup, and each access is recorded in the audit trail. If a model request could carry them, it must use zero-data-retention endpoints, and it fails rather than go anywhere that would keep them.
No, and it is enforced, not just promised. Every model call is sent with data collection denied, which excludes providers that store or train on inputs. The default would allow them, so this is an active setting. Our account settings with our model gateway also exclude every training endpoint. Only two files in our code can reach a language model, and both use the same settings, so a new feature cannot skip this by accident. Search embeddings run inside our database provider, not at a model provider.
The company owner can download your company's records and files in one archive, and reports, CSVs and files download in the product. If you leave, we keep your data for 60 days so you can take it. We will not hold your data back over a dispute. That is written into the Terms, not just stated here.
Our approved security and privacy policies cover access, company devices, privacy requests, incident response, supplier reviews and recovery. Julien de Bats, founder/CEO, is accountable for these practices. Training, risk review and management review support the controls built into the product.
Our processing terms, policies and supplier register are published for your legal and security teams.
Our approved policies, named ownership and the privacy-request procedure.
ReadOur two roles, health and location data, transfers, retention and your rights.
ReadArticle 28 terms with the three annexes a DPO asks for, in full.
ReadEvery third party that touches personal data, compiled from the source code.
ReadData ownership, liability, termination and the export path out.
ReadWhat the platform may and may not be used for, and how we enforce it.
ReadShort, because this site sets none outside the booking page.
ReadHow to report a vulnerability, and what we commit to in return.
ReadEmail security@dmcpilot.com. We reply within two working days and keep you informed. Our disclosure policy provides a process for good-faith research, coordinated reporting and acknowledgement.
We would rather answer it before you buy than after. You get the documents, and a call with the people who built DMC Pilot.
