We use essential cookies to make our site work. With your consent, we may also use non-essential cookies to improve user experience and analyze website traffic. By clicking “Accept,” you agree to our website's cookie use as described in our Cookie Policy. You can change your cookie settings at any time by clicking “Preferences.”
PineChat.ai
Trust & Privacy

Your relationships are the most personal data you have

So we treat them that way. Here is exactly how PineChat handles your data, who touches it, and every legal document in one place.

Compliance

Built to clear your security review

Procurement and InfoSec get what they ask for on day one, so a pilot does not stall in a questionnaire.

Certified
ISO/IEC 27001

Our information security management system is certified by INTERCERT.

Independently assessed
GDPR

Independently assessed for GDPR compliance. A Data Processing Agreement is available on the DPA page.

Report issued
SOC 2 Type II

Our SOC 2 Type II report has been issued. We share it under NDA with prospective customers.

The controls described above are in place today. We share our current security documentation and audit reports with prospective customers on request.

Working through a security review?

We can send a countersigned copy of our DPA for your records, complete your security questionnaire, or provide Standard Contractual Clauses for an EU entity. A real person replies.

Anything else: support@pinechat.ai

Email privacy@pinechat.ai
Encrypted in transit and at rest
Never sold or shared, ever
Disconnect any integration in one tap
Never used to train external AI models
How it works

The details, without the security-review email

Where your data is processed
The United States.
Hosting
Managed cloud infrastructure: Amazon Web Services and MongoDB Atlas, with production isolated from non-production environments.
Encryption
TLS in transit. AES-256 (or equivalent) at rest where technically feasible. Sensitive fields use client-side field-level encryption keyed by AWS KMS.
Access control
Least-privilege, role-based access, with multi-factor authentication on administrative and cloud-console access and documented access reviews.
AI processing
Google Gemini is the sole AI provider. It does not train models on your data.
Breach notification
Customers are notified without undue delay and within 72 hours of us becoming aware of a personal data breach.
Data deletion
On termination, data is returned or deleted within 30 days at the customer’s choice, unless retention is required by law.
Human in the loop
PineChat drafts messages, but never messages your contacts for you. Every message that reaches a person is sent by you.

Full detail, including our technical and organizational measures and the complete list of 10 authorized sub-processors, is in the Data Processing Agreement.

Documents

Everything in one place

Privacy PolicyWhat we collect, why, and the rights you have over your data.Terms of ServiceThe terms that govern your use of PineChat.Data Processing AgreementFor customers: our processor commitments, security measures, and authorized sub-processors.Cookie PolicyThe cookies we set, what they do, and how to control them.Acceptable Use PolicyWhat PineChat may and may not be used for.End User License AgreementThe licence terms for the PineChat software.DisclaimerLimits on the information PineChat provides.
Ask about privacy and security

Ask anything about how PineChat handles your data

Data residency, encryption, what PineChat can and cannot access, compliance paperwork. Answers come from the same material as our trust page.

PineChat
PineChat
online

Ask about pricing, integrations, security, anything.

Answers come from an AI model and can be wrong. Questions are stored for 180 days so we can improve them.

Open the FAQ page →