Security and data handling

Your client's data stays yours

• Project content is scoped to the account that created it. Every project-scoped endpoint checks ownership before it returns anything, so one firm cannot read another firm's projects by guessing an identifier.
• Deliverables, documents and analyses are stored against the project they belong to, not in a shared pool.
• Deleting a project removes its documents and its stored outputs.

We do not train on your content

We do not use client documents, deliverables or analyses to train our own models. We instruct the inference providers we use not to train on your content either.

Where a provider operates a zero-retention mode, it applies; where it does not, the privacy policy says so plainly, including the fact that requests may be retained for that provider's abuse monitoring. If your engagement needs a specific configuration, ask us before it starts rather than after.

What crosses the boundary

Model inference is the only place your content leaves our infrastructure. Everything else — your documents, the verification record, the cost record, the audit trail — stays with us. The provider that receives inference requests, and what it receives, is listed in the privacy policy.

Encryption and transport

• All traffic to the platform is over TLS, and certificate verification is required.
• Stored objects — uploads and exported deliverables — are encrypted at rest.
• Database connections are TLS-verified; insecure connections are not silently accepted.

Access control

• Every workspace route requires an authenticated owner of that project.
• Public routes are limited to the free tools and the reading of published research, and each is rate limited by caller.
• The spreadsheet and formula execution environment runs with the file, network and import escapes closed, so a formula in a client file cannot reach the rest of the machine.

The verification record

When a deliverable is produced, the platform records which sources it cited, which of those the client actually sent, and which numbers in the output appear in the client's documents. That record is stored with the engagement, so it can be reviewed later — including by someone who was not there when it was produced.

This is a record of checking, not a guarantee. We do not claim zero errors and we do not claim the checks are exhaustive.

What we do not offer

We are a boutique-scale platform, not an enterprise procurement department, and it is more useful to say what is not here than to imply it is:

• no single sign-on or SCIM provisioning;
• no customer-managed encryption keys;
• no dedicated deployment, and we do not describe the platform as if it were dedicated to you;
• no security certification. We are not certified and do not claim to be.
• no guaranteed incident response time. If an incident affects your data, we will tell you promptly and in writing, but we have not published a contractual clock we would not always meet.

What we do offer: a data processing agreement, per-project deletion, and a named contact for security questions.

Questions

If a client's procurement team asks something this page does not answer, ask us directly. If the answer is no, the answer is no — and if it is "not yet", that is what we will say.