RevenuePilotby Foxes TechnologyRevenuePilot runs a single closed loop: connect one source of truth, reconcile the economics you already own, receive three ranked and quantified decisions, act inside guardrails you set, and record the outcome so the next decision is better evidenced than the last.
Every stage produces evidence the next stage depends on. If a stage cannot be evidenced, the loop stops there and says so rather than continuing on an assumption.
Your booking or reservation system stays the source of truth. RevenuePilot reconciles and reads back; it never takes silent ownership of your catalogue, your availability or your prices.
Products, options, departures, bookings, cancellations, costs and commissions are reconciled into seven canonical contracts. Missing variable cost or commission produces a flagged cost-coverage gap rather than a default value.
A deterministic engine derives booking pace and remaining capacity, compares them against historical lead-time cohorts, calibrates confidence from its own recorded hindcast error, and applies your guardrails as hard constraints.
Every workspace starts in an advisory posture. Live price execution is disabled globally today, and enabling it for a connector is a certification and qualification process, not a preference toggle.
What was estimated, what was executed, what was verified against the source and what was realized are kept as four separate values, so the next decision inherits measured reality instead of an optimistic summary.
RevenuePilot reads. It reconciles what it reads against its own canonical model, and it reads back after any write it is ever permitted to make. There is no path where your catalogue quietly becomes ours.
The Generic API and CSV are the universal paths and are available now. A controlled pilot connector exists for Egypt Excursions Online, the Foxes Booking Engine is a read connector, and Rezdy and Bókun are certification-ready rather than certified.
CSV uploads are encrypted in the browser with AES-256-GCM, stored through signed private object storage against canonical templates, and validated asynchronously with partial-row reporting so a single malformed row does not discard the file.
The Generic API connector advertises exactly what it uses: catalog_read, departure_read, booking_read and price_read. Inbound keys are organization-scoped and stored as hashes, so a key can be verified but never re-read.
Reconciliation is where most revenue tooling quietly guesses. RevenuePilot treats 'empty' and 'failed' as different states, and treats an unknown cost as unknown rather than as zero.
| Canonical contract | What it holds | How a gap is handled |
|---|---|---|
| Products | The sellable catalogue as your source defines it | Unreconciled products are excluded from decisions and listed |
| Options | Immutable option identity beneath each product | A missing option mapping blocks pricing lookup for that option |
| Departures | Explicit timezone plus a UTC instant for every departure | An ambiguous departure time is rejected, never inferred |
| Bookings | Reconciled demand used to derive booking pace | Stale source data is surfaced as stale, not silently trusted |
| Cancellations | Net demand after cancellation activity | Unreconciled totals raise a reconciliation mismatch |
| Costs | Verified variable cost per product or option | Missing cost produces a flagged cost-coverage gap |
| Commissions | Channel commission applied to contribution | Missing commission withholds the margin view for that product |
The decision itself is arithmetic you can inspect. The AI surface explains that arithmetic; it has no route to create, alter or execute a decision.
The engine derives booking pace and remaining capacity from signed source data and compares them against historical lead-time cohorts. It persists its own hindcast error and coverage, then calibrates a confidence score from that record instead of asserting one.
Minimum confidence of 85, maximum movement of 5% per change, a cooldown of at least 24 hours, and your price floor and ceiling are evaluated in code. A proposal that violates any of them is rejected outright rather than clipped to fit and shipped anyway.
Source, economics, uncertainty, policy boundary and the required operator action travel with the recommendation. Generation is idempotent, keyed by organization, request key, request hash, source snapshot, policy and cycle, so a replay returns the existing recommendation and mismatched evidence raises a conflict.
The automation ladder exists in full, and it is deliberately gated. Live price execution is currently disabled globally and external writes are disabled by default; the machinery is built and held closed rather than shipped open.
| Stage | What the workspace does | What it takes to reach it |
|---|---|---|
| Observe | Reads and reconciles; produces the first Revenue Leak Audit | A connected canonical source |
| Shadow | Generates recommendations and records them without acting | Reconciled economics and reviewed guardrail policy |
| Assist | An operator approves each individual change before it is applied | Certification, owner-approved costs and mappings, policy review |
| Autopilot | Applies approved moves within policy without per-change approval | Shadow qualification, a restricted one-tour canary and signed acceptance |
Most revenue claims fail because an estimate and an outcome were reported as the same number. RevenuePilot keeps them apart on purpose, including when the separation is unflattering.
An estimate is what the engine projected. An execution is what was applied. A verification is what the source and the public quote confirmed afterwards. A realization is what the reconciled data later shows. These are stored as four distinct values, and the interface never quietly substitutes one for another.
A contribution-margin lift claim requires a holdout or a matched control. Before-and-after arithmetic across a changing season, a changing channel mix and a changing catalogue is not causal proof, and RevenuePilot does not present it as one.
No duration is promised here, because the honest answer depends on the state of your data. What is fixed is the order, and the fact that nothing in this sequence can change a price.
Owner, admin, revenue manager, analyst and viewer are distinct roles with distinct permissions. High-impact actions require TOTP step-up, and the audit trail is append-only from the first action onward.
Either a scoped connector or an encrypted CSV upload against a canonical template. Ingestion must match the single configured source, and validation reports which rows were accepted and which were not.
Variable cost and channel commission determine whether the engine can rank on contribution rather than headline revenue. Where they are absent, the workspace shows a cost-coverage gap and withholds the margin view instead of estimating one.
The audit is generated deterministically from what you connected. It is the first honest read of where the arithmetic says exposure sits, and it is non-executable by construction.
Floor, ceiling, movement cap, cooldown and confidence floor are your configuration. Once set, the workspace queue holds three quantified decisions at a time, each with its receipt, so a revenue review has a defined end.
The loop is fully usable without any price ever being written. Moving beyond advisory is a separate, evidenced decision that involves certification, qualification and your explicit approval.
Not today. Live price execution is currently disabled globally and external writes are disabled by default. Enabling execution for a connector requires certification, shadow qualification of 14 consecutive days with at least 20 eligible recommendations, owner-approved costs and mappings, policy review, and a restricted one-tour canary with signed acceptance.
No. Your booking or reservation system remains authoritative. RevenuePilot reconciles what it reads into its own canonical contracts and reads back after any permitted write. It does not take silent ownership of your catalogue, availability or pricing.
The workspace records a flagged cost-coverage gap and withholds the contribution view for the affected products. Empty and failed are treated as different states, and nothing is silently defaulted, because a zero-cost assumption produces a confident recommendation built on a number nobody supplied.
No. Revenue Copilot is advisory: it explains, compares and investigates. It cannot change a price or a guardrail, and those paths do not accept model output. The Model Context Protocol server shipped per workspace is read-only, with six read-only tools and zero execution routes.
Tenant isolation uses forced PostgreSQL row-level security, so scoping is enforced in the database rather than only in application code. Connector credentials are encrypted with AES-256-GCM and are never returned after storage. The audit trail is append-only, and audit CSV export is available on the Growth and Scale plans.
Plans are Starter at $49, Growth at $149 and Scale at $399 per month. Production card collection is currently disabled, so approved founding operators can create a verified account without being charged while the execution gates stay closed.