> ## Documentation Index
> Fetch the complete documentation index at: https://docs.piperai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security at Piper AI: Protecting Your Revenue Data

> Learn how Piper AI safeguards your revenue data with enterprise-grade encryption, certifications, access controls, and continuous monitoring.

Piper AI is built with security as a first principle. From the moment your meeting data is captured to the point it surfaces in your CRM, every step is protected by enterprise-grade controls, independently audited certifications, and strict access policies. This page gives you a high-level map of our security posture — follow the links in each card to dive deeper.

<CardGroup cols={2}>
  <Card title="Encryption" icon="lock">
    All data is encrypted at rest using **AES-256** and in transit over **TLS**. A web application firewall and DDoS protection guard every public endpoint, and annual penetration testing validates our defenses.
  </Card>

  <Card title="Certifications" icon="shield-check">
    Piper AI holds **ISO/IEC 27001** and **SOC 2 Type II** certifications, is **GDPR compliant**, and conforms to the **EU AI Act**. We are audited annually to maintain these standards.
  </Card>

  <Card title="Access Controls" icon="users-gear">
    **Single Sign-On (SSO)** and **Role-Based Access Control (RBAC)** ensure only the right people reach the right data. Continuous monitoring and detailed audit trails give your security team full visibility.
  </Card>

  <Card title="Data Privacy" icon="eye-slash">
    Piper never trains AI models on your data, retains no data after processing, and stores all EU customer data within the EU. Built-in consent management keeps every recording GDPR-compliant.
  </Card>
</CardGroup>

## Infrastructure security

Piper AI's infrastructure is hardened at every layer:

* **Encryption at rest** — AES-256 protects all stored data, including recordings, transcripts, and CRM-synced fields.
* **Encryption in transit** — TLS is enforced on all connections between your browser, the Piper platform, and any integrated third-party services.
* **Web application firewall (WAF)** — Malicious traffic is blocked before it reaches our application layer.
* **DDoS protection** — Volumetric and application-layer attacks are automatically mitigated.
* **Annual penetration testing** — Independent security researchers test our systems annually; findings are remediated and tracked to closure.
* **Vulnerability scanning** — Automated scans run continuously against our infrastructure and application code.

## Organizational security

Technical controls are only as strong as the processes behind them. Piper AI maintains:

* **Quarterly risk assessments** — We formally review threats and adjust controls on a rolling basis.
* **Security training** — All staff complete security awareness training on a recurring schedule.
* **Continuous monitoring** — Real-time alerts fire on anomalous access patterns or configuration drift.
* **Detailed audit trails** — Every administrative action and data-access event is logged and retained, giving you a full record for compliance reviews.

## Application security

Within the Piper application itself, access is tightly controlled:

* **SSO** — Connect Piper to your identity provider so authentication is centralized and enforced by your existing MFA policies.
* **RBAC** — Admins, managers, and standard users each have a clearly scoped permission set. Sensitive configuration changes are restricted to Admin roles.
* **Sharing controls** — Transcription visibility can be set to *Private*, *Team*, *Participants only*, or *External link*, giving you fine-grained control over who sees meeting content.

<Note>
  Admin users can change sharing settings for any transcription they have access to. Standard users can only modify the settings on their own transcriptions.
</Note>

## Learn more

<CardGroup cols={2}>
  <Card title="Data Privacy" icon="database" href="/security/data-privacy">
    No-training policy, consent management, EU data residency, and your right to delete.
  </Card>

  <Card title="Compliance" icon="file-certificate" href="/security/compliance">
    Full details on our ISO 27001, SOC 2 Type II, GDPR, and EU AI Act certifications.
  </Card>
</CardGroup>