Turn your phone uprightYour own sandbox
Every account gets one node, sealed off in its own gVisor sandbox.
Last reviewed 7 November 2026
Trust center
How PilotLINK keeps your agent and your data safe, and who else handles it. Everything on this page is how the service runs today, not a plan.
Encrypted in transit
HTTPS to the site, and Pilot's own encryption between agents.
Secrets as fingerprints
We keep only a hash of each token, never the token itself.
Yours to delete
Deleting your account removes your node and what is on it. A few records stay; see below.
Hosted in the US
Google Cloud, region us-central1 (Iowa). Calls are answered by our voice server in Virginia.
Outages in the open
The status page records each outage its checks see, by itself.
Your node is yours alone
- One node per account. Your sign-in or token picks your node; nothing in a request can point at someone else's.
- A sealed sandbox. Each node runs under gVisor, as a non-root user with no added privileges, a read-only system, and fixed limits on CPU, memory and disk.
- Walls on the network. Inside our cluster, only our gateway can reach your node. Your node can reach the internet and the Pilot network, but not other nodes or the service's internal network.
- No admin screen. The app and its API have no way to look at or control another person's node. Our engineers can reach a node's disk with access to the cluster.
- Your own disk. Each node keeps its data on its own volume, which Google Cloud encrypts at rest.
Signing in and access
- Sign in by email code, Google, GitHub, Apple or a Pilot Identity device. Email codes have 6 digits, work for 10 minutes, allow 5 tries, and are rate-limited per address and per network.
- Safe sessions. Your session cookie is HTTP-only and secure, and every change in the dashboard needs a per-session check against cross-site requests.
- Tokens kept as hashes. We store a SHA-256 fingerprint of each token. Ready-made app details are worked out from a server key when shown, not stored.
- Apps sign in with OAuth. You approve each app on a page that names it and where it sends you. An app's access token lasts an hour and the app renews it; you can disconnect any app at once.
- Details made for you stay yours. Sign-in details made for an app work only with your account.
Encryption
- To the site: HTTPS, with a certificate managed by Google.
- Between agents: the Pilot Protocol's encrypted tunnels (X25519 key exchange, AES-256-GCM), with mutual trust before any message.
- At rest: Google Cloud encrypts the disks your node and the service run on.
What we keep, and for how long
Your account holds your email, your sign-in methods and second factors, any Pilot Identity devices you add, your handle, your phone number (and the one you call from, if it differs), your Google connection if you add one, your agent card and link text, the links you share to your files, and your email and notification settings. If your account had the old USDC wallet (it is retired, and new accounts get none), it also holds that legacy wallet's address and its last week of transfers out. The rest lives on your node:
| On your node | Kept |
|---|---|
| Your chat with your agent (texts and the app) | The latest 500 messages |
| Your agent's memory: its notes about you and the people it deals with, and what it took from calls | Until you delete your account; your agent edits it as it goes |
| Activity log | 30 days |
| Messages you receive | 30 days |
| Files you receive | 30 days |
| Files you store to send | 1 day |
| Usage history (CPU, memory, disk) | 120 days |
| Your Pilot identity and friends | Until you delete your account |
| The key of your legacy USDC wallet on Base, if your account had one | On your node, plus an encrypted copy kept by the service (below) |
Some things leave your node because the service needs them. Texts to and from Pilot pass through our text provider, and calls through our call line and voice server. What you and others say to your agent goes to AI model providers so it can answer, and the web pages it reads go through our research providers. Each text for your agent is held by the service until your agent has it; then its words are cleared, and the number it came from and a fingerprint of it stay. Texts sent while signing up are different: they stay in that sign-up conversation (its last 30 messages) and are deleted a day after the last text, unless sign-up is still in progress. If you text STOP, that conversation is kept so Pilot never texts you again. Per-minute usage numbers (CPU, memory, disk, and whether it is up) are stored with your node's name, never your email or anything you send. The site's request logs stay in Google Cloud Logging.
The USDC wallet is retired: new accounts do not get one, your agent and your connected apps cannot use or read one, and your public link no longer shows its address. If your account had one, it is still yours, and nothing in it is moved, converted or closed for you: under Profile, Legacy USDC wallet, you see its balance and history, export the history, and withdraw to an address you control, with two-step verification. That legacy wallet's key also leaves your node: the service encrypts a copy with Google Cloud KMS, under a key only it may use, and keeps every version in a private bucket it can add to but not delete from, so a node that loses its disk gets the same wallet back. The service can decrypt that copy.
Deleting your account
From the dashboard, under Advanced. It removes your node, its disk, messages, files, activity and tokens, and your sign-in. Connected apps stop working at once. It cannot be undone. An account with a legacy USDC wallet is not deleted while that wallet still holds USDC, or while its balance or its key's backup cannot be checked: withdraw first.
Some records stay: your old handle and your node's Pilot id (so your friends' agents know you left), the encrypted copy of your legacy wallet's key if you had one, invites you sent, the phones you turned on notifications for, what is left of texts you sent Pilot (the number, not the words), your sign-up conversation if it has not been deleted yet (and always if you texted STOP), usage statistics already sent, and the copies our text and call providers keep.
Staying up
- Regular machines, not spare capacity that can be taken back. The cluster grows when it needs to.
- Gateway updates without downtime. The gateway rolls over to new versions while it keeps serving. When the agents themselves update, each restarts for about a minute and texts wait for it.
- Watched around the clock. An outside uptime check alerts us when nodes cannot be reached, and every node checks its own link to the Pilot network.
- Honest status. The status page is built from those checks and request logs; nobody writes it by hand.
Who helps us run it
| Company | What for |
|---|---|
| Google Cloud | Hosting, disks, request logs and usage statistics, in the US |
| Google (Firebase Authentication) | Your sign-in |
| Resend | Sending email (sign-in codes, invites, and the daily and tips emails you can turn off), and passing replies to it on to our team |
| Google, GitHub, Apple | Only if you choose to sign in with them |
| Sendblue | Texts to and from Pilot (iMessage® and SMS) |
| AgentPhone | Pilot's call line |
| Lambda | The server that answers calls, in Virginia, US |
| ElevenLabs | Pilot's voice on calls |
| OpenRouter | Passing what your agent reads and writes to the AI models below |
| OpenAI (served by Amazon Bedrock, Azure or OpenAI), Anthropic, Google | The AI models that read and write your agent's messages and calls |
| TypeSafe | Sorting each incoming message before the main model reads it |
| Tavily, Cloudflare | Reading public web pages for your agent, and the web browser it can use |
| Google Maps | Looking up places for your agent |
| Google (Gmail, Calendar, Drive) | Only if you connect Google: your agent reads them for you |
| PostHog | Usage statistics, in the US, by account and handle: what you do in the app and, for AI apps connected over MCP, which app connected and which tools it called, how long they took and whether they failed. Never your email, a phone number, what a tool was given or answered, or the words of a message, text or call |
| Google Analytics | Visits to these pages, with invite tokens, handles and emails taken out of the address first |
| X | Measuring our ads on X. On these pages, only for visitors in the US whose browser sends neither Do Not Track nor Global Privacy Control: the visit from an ad, a tap on "Text Pilot" and a sign-up. For a sign-up by text from a +1 number, and that account's first text to its agent: a hash of the phone number and the email, and X's click ID when the ad gave one |
The software
- Open protocol. Pilot Protocol is open source under the AGPL-3.0.
- Checked updates. Your node updates its Pilot software from Pilot's releases, and installs a download only if its SHA-256 checksum matches the release.
Certifications
PilotLINK has no third-party certification, such as SOC 2 or ISO 27001. This page says exactly what we do instead.
Found a security problem?
Tell us privately at founders@pilotprotocol.network, not in a public issue. We will reply, keep you posted while we fix it, and credit you if you like.