Privacy Policy

BucketPilot (bucketpilot.io) is operated by Bucket Pilot, Inc., a Delaware corporation.

Registered office: 2810 North Church Street, Wilmington, DE 19802, United States.

For the personal data of people in your organisation, you are the controller and we are the processor — we act on your instructions. For the data of the person who signs up and pays, we are the controller.

Reach us about anything on this page, including a request to exercise your rights, at [email protected]. For anything else, [email protected].

Account. Your name, email address and, where you set one, a password — handled by our sign-in provider, so we never see the password itself. Which workspaces you belong to and your role in each.

Billing. Billing contact, plan, invoices and payment records. Card numbers never reach us; they go directly to Stripe.

Storage credentials. The IAM role ARN and ExternalId, or the access keys, tokens and SSH private keys you save, encrypted at rest (section 8).

Object metadata. For each object in a bucket you connect: its name, size, storage class, checksum, last-modified time and the bucket it is in. This is the index the product is built on.

Object contents. See section 3 — the answer is "not persistently, with one exception you choose".

Activity. Who did what, when, to which bucket or job, including refused permission attempts. This is the audit trail, and it is visible to your workspace's admins.

Support conversations. What you send the in-app assistant, and what you email us.

Technical. IP address, user agent and request metadata, from serving the site and from protecting it at the edge.

Usage analytics. Pseudonymous events about how the product is used (section 10).

We do not persistently store the contents of your files. What BucketPilot keeps is metadata — an index of object names, sizes, storage classes, checksums and timestamps — which is what makes search, cost analysis and incremental backup possible.

Browser transfers never touch our servers. Uploads and downloads run over presigned URLs directly between your browser and your own storage.

A backup or migration you configured is the one exception in the product. While that job runs, our infrastructure streams object data from the source you named to the destination you named. It is not written to disk on our side and it is not retained.

BucketPilot Cloud is the deliberate exception. Files you put in a Cloud bucket are stored by us — through our storage provider, in the region you chose for that bucket and nowhere else, as regions are not replicated to each other — for as long as the bucket exists.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your content — files, metadata or support conversations — to train machine-learning models, ours or anyone else's.

We use these subprocessors. Each is bound by contract to protect the data it handles and to use it only for the purpose below.

We keep this list current as part of the change that introduces the vendor. If you would like advance notice of changes, tell us at [email protected] and we will email you before a new subprocessor begins processing your data.

Other than these, we disclose your data only where you tell us to, or where the law compels it — and where the law compels it we will tell you unless we are forbidden to.

Our application, its databases and the object index run in AWS ap-south-1 (Mumbai). Several of the providers in section 5 are in the United States, so operating the service involves transferring personal data internationally.

Where that transfer is from the UK or the EEA, it is made under the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), which is the mechanism our agreements with those providers use.

BucketPilot Cloud is different, and deliberately so. A Cloud bucket's files stay in the region you chose for it. Regions are not replicated to each other — that is why a second copy in a second region is something you set up as a backup job, rather than something that happens quietly.

Closing your account really deletes it. It cancels the subscription, ends the sessions and hides the workspace at once, and deletes nothing for 30 days so that a misclick is recoverable. After that the record is deleted and what depends on it goes with it. We keep only what the law requires us to keep — principally the invoice record.

The audit CSV export on the Business plan is the only way to keep activity beyond 100 days, which is why that window is stated here and in the docs rather than left as an implementation detail.

These are the measures actually in place. Our security documentation goes further into each.

• •Credentials are encrypted at rest with AES-256-GCM and are never returned by any API after saving. The recommended AWS path stores no long-lived key at all: a least-privilege IAM role in your account, assumed with a unique ExternalId, revocable by you at any moment by deleting the stack.
• •Everything is TLS in transit, and the application enforces HSTS.
• •Browser uploads and downloads bypass us entirely, over presigned URLs straight to your storage.
• •Tenant isolation is the product's spine. Every resource belongs to exactly one workspace, and nothing crosses between them; organization roles and per-bucket and per-folder grants decide what each person reaches inside one.
• •Every meaningful action is recorded, including denied attempts, and admins can read and export it.
• •SSH host keys are pinned on first connect. A changed key stops jobs and shows both fingerprints rather than silently trusting a possibly-impersonated server.
• •API keys are stored as hashes and rate-limited per key, and the public API is read-mostly by design.
• •Keys you paste with more permission than the task needs are flagged at the moment you save them.

No system is perfectly secure, and we will not pretend otherwise. What we will do is tell you when something goes wrong — see section 11.

Depending on where you live, you have some or all of these rights over your personal data: access it, correct it, delete it, restrict or object to how we use it, take it with you in a portable form, and withdraw consent where consent is what we relied on.

Much of this you can do yourself: Settings edits your details, and closing your account starts the deletion in section 7.

For anything else, write to [email protected]. We will answer within 30 days. We will not charge you, and we will not treat you differently for asking.

If you are in the EEA or the UK, you may complain to your data protection authority. We would rather you told us first.

If you are in California, we do not sell or share personal information as the CCPA defines those terms, and we do not offer financial incentives for it.

If your data reached us through your employer's workspace, they are the controller: we will pass your request to them and support them in answering it.

We use cookies and similar storage for two things.

Necessary — signing you in and keeping you signed in, remembering your workspace and your light/dark preference, and protecting the site. These cannot be switched off without breaking the product.

Analytics — Google Analytics 4, to understand which parts of the product get used. Events are pseudonymous: where an account is identified it is by our own numeric account id, never an email address or any other directly identifying detail. We do not run advertising or cross-site tracking cookies.

Your browser can block or clear cookies; blocking the necessary ones will stop you being able to sign in.

If we discover a breach of security that affects your personal data, we will notify you without undue delay and within 72 hours of becoming aware of it, by email to the account's address. The notice will say what we know, what we do not yet know, what we are doing about it, and what — if anything — you should do.

We will not wait for a complete picture before telling you. A late, complete notice is worth less than a prompt, honest, partial one.

We hold no third-party security attestation today. Not SOC 2, not ISO 27001. We state this plainly because a vague implication of one is worse than its absence: you would be relying on something that does not exist.

What is in place is the substance those frameworks examine, and it is described rather than asserted — the controls in section 8, the subprocessor register in section 5, the retention schedule in section 7, the breach commitment in section 11, and the change history at the end of this page. Each is implemented in the product and can be demonstrated.

When an attestation is completed, this section will name it: its type, the period it covers, the auditor, and how to request the report under NDA. It is the one place on this site that will ever say so, and no other page will claim it before this one does.

Until then, if your procurement process needs a security questionnaire answered, a data processing agreement, or a call with the people who built it, write to [email protected]. You will get an engineer.

BucketPilot is a tool for work and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to [email protected] and we will delete it.

We update this policy when the product changes — in the same change, so it never describes a version of the product that no longer exists.

The effective date at the top states which version is in force, and every past change is listed below. Where a change materially affects how we handle your data, we will tell you by email or in the product before it takes effect.