NitePilot

Security at NitePilot

Last updated 25 October 2026

NitePilot separates customer organisations and venues in application authorization, database row-level security and private object-storage paths. Sensitive support access is customer-approved, short-lived and audited.

Controls

Controls include least-privilege roles, protected server credentials, password hashing, session revocation, signed billing webhooks, append-only audit events, private storage, encrypted ID fields and retention jobs.

Responsible disclosure

Report a suspected vulnerability privately to security@nitepilot.co.uk. Do not access customer data, disrupt service or publish details before we have acknowledged and investigated the report.

Assurance status

Production onboarding remains subject to migration rehearsal, backup restoration, penetration testing and supplier/security review. This page does not claim a certification that has not been independently awarded.