It And Managed Service Providers
Yes, from exports rather than from your PSA: Autopilot Assistant reads the ticket and backup exports you put where it can reach them and, on a schedule you set, drafts each client's monthly or quarterly report as a Word, Excel or PowerPoint file modelled on the last one you sent. It has no PSA or RMM connector, and someone at your firm must check every figure before a report goes to a client.
It is the second working day of the month and twenty-odd client reports are due by Friday. For each one you export the closed tickets, pull the backup job history out of the console, open last month's Word file for that client, change the dates, rebuild the chart and rewrite the same four paragraphs around new numbers. Nobody pays for those hours, and for some clients that report is the only part of the month's work they ever see, so it cannot be sloppy, and it certainly cannot say a backup succeeded when it failed. You have also told every client, more than once, not to paste company data into a public chatbot. Their ticket history names their people, their machines and what broke on them. You are not going to be the first to do it.
No. There is no PSA connector and no RMM connector, and nothing here should be read as hinting at one. Autopilot uses only what you connect to it, each connection separately: a mailbox, a calendar, Drive for files, code repositories, and a Telegram thread if you would rather talk to it there. So the month's material reaches it the way you already move it around — you run the exports, then put them in a folder in the Drive you connected or send them to the mailbox you let it read. It works from those files, not from the tools that produced them. That is a limit, and it is also a control: you decide which exports go in, so you decide how much of your PSA and RMM it ever sees.
It works from yours, not from a template of its own. Point it at last month's report for a client — the Word file, the spreadsheet or the review deck — together with this month's exports, and it drafts the new one in the same shape: your headings, your order, your way of describing a quiet month or a bad one. It keeps the thread across a task, so a layout instruction given for the first client in a run carries to the next. What comes back are finished files you open in your own software: Word (.docx), Excel (.xlsx), PowerPoint (.pptx) or PDF, with charts where the report has them.
Yes. It can act later on a schedule, so the drafting can be set for the morning after month-end and the drafts are waiting when you sit down. A schedule cannot make the exports exist, though: it works from what is in the folder when the run begins, so the exports have to land there first. And because reading your mail and sending from it are separate permissions, granted one at a time, it can read the mailbox the backup summaries arrive in without being allowed to send a single message from it.
Every figure, every date and every statement about a client's systems, against the export it came from. That is the rule for anything this assistant produces, not small print. It is not a research tool, and it is not an auditor either: ask it to write up what the exports show, never to judge whether a client is secure or what a law requires of them. Start with the response numbers. In its section on incident response, the Canadian Centre for Cyber Security's guidance for organisations buying managed services says the service level agreement should specify expected turnaround times, communication media, escalation processes, metrics for assessing performance, and penalties for not meeting turnaround times. Where your agreements were written along those lines, the turnaround figures are the ones with penalties attached.
Mostly your clients' staff: names, email addresses, and what went wrong on whose laptop. There is no single answer to which law applies. The Office of the Privacy Commissioner of Canada's summary says PIPEDA applies to private-sector organisations that collect, use or disclose personal information in the course of a commercial activity, and also to the personal information of employees of federally regulated businesses; that Alberta, British Columbia and Quebec have their own private-sector laws, deemed substantially similar; that Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have adopted substantially similar laws for personal health information; and that businesses handling personal information that crosses provincial or national borders in the course of commercial activities are subject to PIPEDA regardless of the province. Which of those reaches a given client's export depends on the client, the province and whose information it is. That is a question for the client or a lawyer, and we will not pretend to settle it here.
Where PIPEDA applies, clause 4.1.3 of its accountability principle is short: an organisation is responsible for personal information in its possession or custody, including information transferred to a third party for processing, and shall use contractual or other means to provide a comparable level of protection while the third party processes it. On our reading, handing exports to this assistant is that kind of transfer. The OPC's interpretation bulletin on accountability, which it describes as a guide to compliance rather than a binding legal interpretation, adds the sharper line: even with an appropriate outsourcing contract in place, an organisation may be in contravention if it cannot confirm what happens to personal information after it is provided to a third-party service provider. So ask us that question before the first export goes in, and keep the answer in writing.
Plainly: the exports leave Canada. The assistant runs on a private virtual machine for your business alone, in Canada, but the AI work on what it reads and writes — each export, each draft — is processed in the United States. Our privacy page sets out what is stored where and which provider handles what. Expect the question. The Cyber Centre tells organisations buying managed services that they are the data owner and legally responsible for data security, and the questions it suggests putting to a provider include whether it can support storing their sensitive data within Canada and how the MSP reviews a vendor when it contracts with a sub-processor. Once this assistant drafts a client's report, it is part of your answer to both. The same guidance goes further: it recommends that organisations outside the federal government store data they rate at medium or high sensitivity only in data centres in Canada. The OPC's bulletin also says organisations outsourcing to a foreign-based service provider should tell individuals that their information may be available to that country's government under a lawful order made there. If a client's agreement or its own policy says its data stays in Canada, its exports stay out of the folder.
Work on the basis that they could. The assistant's memory is shared by everyone at your business rather than kept private per person, so treat it as one place that may hold material from every client whose exports you have given it, and read each draft for anything that belongs to somebody else. Deleting a chat does not erase the assistant's own copy, which matters on the day a client leaves and your agreement says their data is destroyed. PIPEDA's clause 4.5.3 says personal information no longer required to fulfil the identified purposes should be destroyed, erased or made anonymous, and that organisations shall develop guidelines and implement procedures to govern its destruction. Ask us how a departing client's material comes out of the assistant before you sign, not after.
An illustration: the firm and its clients are invented, and nothing here describes a customer. The firm is three people looking after twenty-two small offices, most on a monthly report and two on a quarterly review. At the end of the last working day of the month, whoever is on the desk runs two exports for each client — the month's closed tickets as a spreadsheet, and the backup console's job summary as a PDF — and saves them in that client's folder for the new month, in the Drive the firm connected to the assistant. Last month's report for each client sits beside them as the model. The run is scheduled for the next morning. For each folder the assistant drafts a Word report in the model's shape: a short account of the month, a chart of tickets by category, a table of backup jobs and how each one ended, and the tickets still waiting on a decision from the client. For the two quarterly clients it drafts a slide deck instead. The owner then reads every draft against its two exports. In one, a reopened ticket has been counted twice in the chart, and she corrects it. In another she cuts a sentence calling a phishing report an incident, because the firm's agreements reserve that word for something specific. In the dental office's report she adds a paragraph of her own about replacing the front-desk computer. She sends each report from her own mailbox; the assistant was never given permission to send. One client, a clinic whose agreement says its data is processed only in Canada, has no folder at all: its exports never go to the assistant, and its report is written by hand, the way all of them used to be. What the illustration does not show, because none of it would be true: a connection to the PSA or the RMM, a report going out unread, or a number of hours saved.
Yes. It reads PDFs, so a PDF job summary can sit in the folder next to the ticket export. Check what it carries across from a PDF as closely as anything else: a table lifted out of a PDF is still a number going to a client under your name.
Only if you give it permission to send mail, which is separate from permission to read it. We would not begin there. The value of a draft is that somebody at your firm reads it against the exports before it goes, and the simplest way to be sure that happens is to send each report yourself.
Do not rely on it for that. It works from what it has been given to read, so a job that failed this morning shows up in a report only if it is in something the assistant has read. Alerts stay with the tools that watch the backups.
Not with private memory. The assistant runs on a private virtual machine for your business alone, and its memory is shared by everyone who uses it there. If some clients' information must be kept from some of your colleagues, raise that on the setup call before anything goes in, because it changes how you could use it.
With a person rather than a form; there is no self-serve signup. We prepare the machine, go through what it should know about your firm and how your reports are laid out, and connect only the accounts you choose. Ask us on the call what it would cost for a firm your size.
Setting this up is our work, not a form you fill in. We go through your wording with you, and you can change any of it afterwards.
Digital Front Desk