AI & data handling policy.

SECTION 1Our principle: your policies come first

Your security and data policies take precedence over our methods. You choose how much AI is used on your work (see Section 4), and we work within that choice. Where your requirements are stricter than this policy, yours apply.

SECTION 2Access to your systems

• Electronic sign-off first. We do not connect any tool to your systems without your electronic approval.
• Permission-scoped access. Integrations use HubSpot OAuth or private apps scoped to the minimum access the work needs.
• Read-only by default. Write access is used only when a specific task requires it and you have approved it.
• Least privilege. Each team member and each integration gets only the access the work requires, and nothing more.
• You control access. Your HubSpot admin grants our access and can revoke it at any time.
• Client-hosted option. If you prefer, integrations can run in your own environment, using keys you own and control.
• No unverified apps. We do not connect unverified or unlisted third-party apps to your portal unless you explicitly opt in, electronically, after reviewing what the app can access.
• Secrets handled properly. API keys, tokens, and passwords are never shared by email, chat, or documents. They are stored in managed secret stores. If a key is ever exposed, it is rotated.
• Reviewed before production. Changes are built in a sandbox or reviewed before they reach your production environment. AI never edits a live site directly.
• MFA on every account. Every Pivot team member is required to use multi-factor authentication on every account that touches client data.
• NDAs. We will sign your NDA.

SECTION 3How we use AI

Approved tools for client work

Security certifications of our approved AI vendors

Certifications belong to each vendor; Pivot itself does not hold these certifications. Vendor reports (e.g., SOC 2) are available from each vendor’s trust center.

• Claude (Anthropic, Team plan): SOC 2 Type I and Type II, SOC 3, ISO/IEC 27001:2022, ISO/IEC 42001:2023 (AI management), CSA STAR Level 2, and a NIST 800-171 attestation. GDPR Data Processing Addendum. HIPAA (BAA) is offered only on Anthropic’s Enterprise and API plans, not the Team plan. Trust center: trust.anthropic.com
• Grok Business (xAI): SOC 2 Type I and Type II, HIPAA, GDPR and CCPA, with a Data Processing Addendum. Trust center: trust.x.ai
• Microsoft 365 Copilot (Microsoft): ISO/IEC 27001, ISO/IEC 42001 (AI management), HIPAA (BAA included in Microsoft’s Data Protection Addendum), GDPR and the EU Data Boundary, and ISO/IEC 27018 privacy commitments. Copilot also adheres to Microsoft 365’s existing compliance commitments. Trust center: servicetrust.microsoft.com
• HubSpot Breeze (HubSpot): SOC 1 Type II, SOC 2 Type II (covers Breeze), SOC 3, HIPAA attestation, GDPR (Data Processing Agreement) and CCPA, EU Cloud Code of Conduct (Level 2), and TRUSTe Certified Privacy. Trust center: trust.hubspot.com

Vendor certifications verified from each vendor’s official trust center or compliance pages in November 2026.

• Approved tools only. Only the tools listed above are used with client data. No consumer or free AI tools are ever used on client data.
• No training on your data. Client data is never used to train AI models. Pivot never accepts any vendor offer, such as credits, in exchange for allowing training on business data.
• Retention and sharing controls. Organization-level chat sharing is disabled in Claude, and we do not create public share links. Deleted Claude chats are purged from Anthropic’s systems within 30 days. Grok Business inputs and outputs are automatically deleted within 30 days.
• Human review, always. A Pivot team member reviews AI output before it is delivered to you or acted on in your systems.

SECTION 4Your choice: three levels of AI use

You choose the level of AI used on your engagement. If you do not specify a level, Full is the default.

SECTION 5Calls and recordings

• Call prep uses public information. When we prepare for a conversation with you, we research publicly available information, such as your website, public news, and public profiles.
• Recorded calls. We record client calls using HubSpot or AskElephant notetakers.
• Always visible. Notetakers always appear as a visible participant on the call.
• Consent first. The first time a notetaker joins one of your calls, we tell you, and we record only with your consent.
• Deletion on request. Recordings can be deleted at your request.

SECTION 6Data handling

• Data stays in your systems. Your data stays in your HubSpot portal and, wherever possible, in your own systems.
• Secured working copies. When an export or working copy is needed for agreed work, it is kept only in Pivot’s secured business accounts, with access restricted to the team members working on your engagement.
• Protected dashboards. Client dashboards are password-protected.

SECTION 7End of engagement

Within 30 days of the end of an engagement, we complete the following and confirm it to you electronically:

1. Remove Pivot users and partner access from your HubSpot portal, and revoke private app tokens, service keys, and OAuth grants.
2. Disconnect AI connectors, and delete AI chats and projects that contain your data.
3. Shut down or hand over any hosted workers, dashboards, databases, and functions, and delete stored secrets.
4. Transfer or delete code repositories, and remove local configuration that contains keys.
5. Delete exports and working copies, and stop scheduled reports.
6. Delete or export call recordings and transcripts at your request.
7. Remove shared logins and Pivot access to your tools.
8. Provide a handoff list along with written confirmation that offboarding is complete.

SECTION 8Incident notification

If your data is accessed or compromised due to an incident on Pivot’s side, we will notify you within 72 hours of confirming the incident. This includes:

• A compromised Pivot account or device
• An exposed key that was used to access your data
• An AI or automation error that affects your records
• Your data sent to the wrong recipient
• A breach at a Pivot vendor that involves your data

We will immediately revoke or rotate affected access, and provide a written summary of what happened and what was fixed.

Exposures that are corrected with no evidence that client data was accessed (for example, a key that was exposed and rotated immediately) are logged and remediated internally. Incidents on HubSpot’s platform are handled through HubSpot’s notification processes.

SECTION 9Security reviews and questions

We complete security questionnaires for any prospect or client, and we are glad to walk your security team through any part of this policy.