Security & Trust
How Pilea keeps your data and your site safe while continuously monitoring your storefront.
How Pilea works
Outside-in, by design
Pilea sees your storefront the same way your customers do. There is nothing to install, nothing to integrate, and nothing to grant access to.
- Analyzes your site entirely from the outside, like a real visitor would
- No script, tag, or SDK is ever installed on your website
- No access to your codebase, servers, admin panel, or infrastructure is required or requested
Scope
What we access
The public-facing pages of your site only — exactly as a customer browsing it would see them.
Nothing behind a login wall is analyzed unless it has been explicitly configured and scoped with you.
Out of scope
What we don't access
- No personal customer data
- No payment information
- No backend or database access
- No admin credentials
- No write access to your site
- Nothing installed on your infrastructure
Infrastructure
Hosting & infrastructure
Pilea is hosted on Google Cloud Platform and follows standard cloud security practices.
Encryption in transit
All traffic to and from Pilea is served over HTTPS/TLS.
Access controls
Production access is limited to authorized team members through cloud identity and access management.
Managed, isolated services
Pilea runs as managed containers rather than long-lived servers, so there is no fleet of machines to patch or expose.
Data processing
Data processing & subprocessors
Pilea relies on a small number of trusted providers to operate the service. Only the data needed to perform each function is shared with them.
| Category | Purpose | Provider |
|---|---|---|
| Cloud hosting & infrastructure | Runs the Pilea application and stores analysis results | Google Cloud Platform |
| AI model providers | Analyze captured public pages to detect UX and conversion issues | e.g. Anthropic, OpenAI |
| Authentication | Secure sign-in for Pilea user accounts | Supabase |
A full subprocessor list and our Data Processing Agreement (DPA) are available on request at founders@pilea.co.
Compliance
GDPR & compliance
Pilea is committed to GDPR compliance for our EU customers. French and EU billing is handled by Pilea France SAS, our French entity based in Lille.
A Data Processing Agreement (DPA) is available on request for any customer who needs one.
Roadmap
Security roadmap
We have begun the process of pursuing SOC 2 compliance as part of our ongoing commitment to enterprise-grade security.
In the meantime, our security program is built on industry best practices — from infrastructure access controls to strict data minimization in how we operate.
Have a security questionnaire or need our DPA?
Contact founders@pilea.co and we'll get back to you within 1 business day.
Contact our team