Security
Last updated: July 21, 2026
How we think about security
IRAPilot handles sensitive information: compensation and contribution data for the plans set up through IRAPilot. We treat that data as the most sensitive category we hold and design our systems around limiting who and what can touch it.
We never hold your money
IRAPilot is setup software and recordkeeping reminders, not a custodian. Employee contributions move from your payroll to accounts held at an independent, IRS-approved custodian. IRAPilot never takes custody of participant funds, which removes an entire category of risk from the relationship.
Encryption
Data is encrypted in transit using TLS, and sensitive data is encrypted at rest. Connections to the application are served over HTTPS only.
Access controls
Access to plan data is restricted to the personnel and systems that need it to provide the service, and that access is logged. Compensation data is further restricted within our systems.
Data handling and retention
We collect only the data needed to set up and run your plan, share it only with vetted service providers, and retain it for the periods IRS and Department of Labor rules require. The full detail is in our Privacy Policy.
Reporting a vulnerability
If you believe you have found a security vulnerability, please email security@irapilot.com with the details and steps to reproduce it. We will acknowledge your report, investigate, and keep you updated. Please do not publicly disclose an issue until we have had a reasonable chance to address it.