Skip to main content
Compliance is not a checkbox at Piper AI — it is an ongoing program backed by independent audits, formal risk assessments, and architectural decisions made at the product level. This page details the four certifications and regulatory frameworks we maintain, what each one means for your organization, and how we sustain compliance over time.

​
Certifications at a glance

Piper AI is certified or compliant under the following standards:
  • ISO/IEC 27001 — International information security management standard
  • SOC 2 Type II — US trust-services criteria covering security, availability, and confidentiality
  • GDPR — EU General Data Protection Regulation
  • EU AI Act — EU regulation governing the development and deployment of AI systems
Each is described in detail below.

​
ISO/IEC 27001

ISO/IEC 27001 is the internationally recognized standard for information security management systems (ISMS). Certification confirms that Piper AI has implemented a comprehensive, risk-based approach to protecting information assets — and that an accredited third-party auditor has independently verified this. What this means for you:
  • Piper’s information security controls are systematically documented, implemented, and reviewed.
  • Risks are formally assessed and treated on an ongoing basis.
  • The entire ISMS — including policies, procedures, and technical controls — is audited annually to maintain certification.
  • You can request a copy of our ISO 27001 certificate through your account manager.
Scope: The certification covers the systems and processes used to collect, process, store, and transmit customer data within the Piper AI platform.

​
SOC 2 Type II

SOC 2 Type II is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). Unlike a point-in-time snapshot, a Type II report covers a sustained period of operation — typically six to twelve months — and validates that controls were not just in place but operating effectively throughout that period. Piper AI’s SOC 2 Type II report covers the Security trust services criterion and confirms:
  • Logical access controls (SSO, RBAC, MFA enforcement) are consistently applied.
  • Change-management processes prevent unauthorized modifications to production systems.
  • Monitoring and alerting operate continuously and incidents are responded to appropriately.
  • Availability and data-integrity controls meet the defined trust services criteria.
What this means for you:
  • Enterprise procurement and infosec teams can review the SOC 2 Type II report as part of vendor due-diligence.
  • The report is available under NDA to qualified prospects and customers — contact your account manager to request it.

​
GDPR

The General Data Protection Regulation (GDPR) governs how organizations collect, process, and store personal data belonging to individuals in the European Union. Piper AI is designed to be GDPR-compliant by default, not by configuration. Key GDPR controls built into the Piper platform:
Piper provides a Data Processing Agreement (DPA) that documents the controller–processor relationship. Request it from your account manager before deploying Piper in a context where you require a signed DPA for compliance purposes.

​
EU AI Act

The EU AI Act establishes a risk-based regulatory framework for AI systems deployed in the European Union. Piper AI has assessed its AI components against the Act’s requirements and operates in compliance with the applicable obligations. Our approach:
  • Piper’s AI systems are classified according to the Act’s risk tiers. Revenue intelligence assistants — summarising meeting content and suggesting follow-up actions — fall within a low-risk category under the Act’s framework.
  • Transparency obligations are met: meeting participants are informed that AI is processing the call via the bot’s connection message.
  • Piper does not use prohibited AI practices as defined by the Act (e.g., subliminal manipulation, social scoring).
  • No customer data is used to train Piper’s AI models, which aligns with the Act’s data-governance requirements for AI systems.
If your organization’s legal team is conducting an EU AI Act impact assessment, contact your account manager for supporting documentation.

​
Maintaining compliance

Compliance at Piper AI is sustained through a continuous program of controls, not annual point-in-time exercises:
  • Annual audits against ISO/IEC 27001 and SOC 2 Type II by independent third-party auditors.
  • Quarterly risk assessments to identify and treat emerging threats.
  • Continuous monitoring of infrastructure, access patterns, and configuration drift.
  • Security training for all staff on a recurring schedule.
  • Penetration testing and vulnerability scanning performed at least annually.
If you have questions about our compliance program or need documentation for your own vendor assessment, contact security@piperai.com or reach out to your account manager.