How we handle your data

Plain answers to what IT and compliance teams ask.

• Encrypted at rest. Uploaded files and parsed data are encrypted with AES-256-GCM before they’re written to disk. All traffic uses HTTPS.
• Isolated workspaces. Every request checks that you’re a member of the workspace and that your role allows the action.
• Retention you control. Files are deleted automatically after 7, 30, 90 or 365 days — your choice — or when you delete them.
• Delete anything, anytime. Files, reports, workspaces and accounts can be deleted instantly from the app.
• No AI training. Your data is never used to train AI models. Only computed facts and a sample of comments are sent to the AI to write the text.
• Numbers from code, not AI. Every figure is calculated from your data, and AI text is checked against those figures.
• Audit log. Uploads, exports, shares, deletions, invitations and setting changes are recorded in each workspace’s activity log.
• Secure sign-in. Passwords are hashed with scrypt; sessions are HttpOnly cookies; sign-in attempts are rate-limited; Google sign-in is available.
• Share links you control. Read-only, optionally password-protected and expiring, and can be turned off or reset at any time.

Need a security questionnaire answered or a data processing agreement? Contact us.