Our operating principles
We request only the fields needed to identify due customers, prepare approved outreach, and measure outcomes.
Every stored record carries a workspace identifier. Server-side authorization must match that workspace before a record can be read or changed.
Production data is encrypted in transit and at rest using the controls provided by our infrastructure and messaging vendors.
Routine support does not require browsing customer records. When record-level access is necessary, the goal is explicit, time-limited permission with an audit trail.
How imports work
CSV files are parsed in the browser so the business can inspect headers, sample rows, and field mappings. The protected importer transmits only normalized approved fields after the owner confirms the mapping; it does not store the original file. Importing data does not send a message.
For supported software connections, the business authorizes access directly with the source provider. Revenue Autopilot stores connection credentials as protected secrets and synchronizes only the records and fields needed for the enabled workflow.
Messaging safeguards
- Carrier registration must be approved before live application-to-person messaging is enabled.
- Every outbound job checks workspace ownership and suppression status.
- STOP and other recognized opt-out signals suppress future outreach.
- Delivery results and failures are recorded so the business can see what happened.
- Imported records never enter a campaign without a separate audience and rule approval.
What we do not promise
Revenue Autopilot does not claim that customer data is invisible to the systems processing it. Delivering the service requires Revenue Autopilot and selected service providers, including messaging infrastructure, to process limited customer information. We describe that processing plainly instead of making a misleading “zero access” claim.
Customer control
Businesses retain ownership of their customer data. Authenticated owners can export their workspace data or permanently delete customer content. Limited one-way suppression hashes may remain after deletion so an opted-out number cannot be accidentally reactivated by a later import.