Your documents are yours
What we do to protect them, what we keep and for how long, and who can see what. Stated plainly.
Separate by organisation
Every record belongs to one organisation, and every request is checked against it. One customer can never read another's agents, documents or results.
Roles and menu access
Admins, builders, reviewers, billing and developer roles, and each person's menus can be narrowed further. The server enforces it, not only the screen.
Sign-in protection
Passwords are stored with Argon2id. Two-step verification with an authenticator app and recovery codes. Lockout after repeated failures. Sessions you can review and end.
API keys done properly
Keys are shown once and stored only as a hash. Limit a key to specific permissions, to one agent, to chosen IP addresses, or make it a free sandbox key. Revoke any time.
Signed webhooks
Every webhook is signed so you can verify it came from us, with replay protection. Targets must be public https addresses.
Secrets encrypted
Stored credentials such as webhook secrets and authenticator seeds are encrypted at rest.
Kept for 30 days, then deleted
Documents you send and the data extracted from them are deleted automatically after 30 days. You can shorten that for your organisation, and delete any document and its extracted data immediately from the API or the screen. Billing records and audit entries are kept; document contents are not.
Sample documents you train with are kept with the agent so you can retrain and restore older versions. Deleting a sample removes it as soon as no saved version depends on it.
Only what is needed to read a document
To read a document, the relevant text or page images are sent to our AI provider under its API terms. Documents the rules can read completely are not sent at all. Our sub-processors are listed in the Privacy Policy, which you review when you sign up.
We do not sell data, and your documents are not used for advertising.
Files are treated as untrusted
- The real file type is checked from the content, not the name
- Macro-enabled and malformed Office files are refused
- Size, page and archive-expansion limits stop abuse
- Previews show text escaped, never as active content
Accountability
Sign-ins, key creation, role changes, payments, publishing and deletions are written to an append-only audit log your admins can read. Platform staff actions on your account are logged too, and a sales contact sees usage and balances, not document contents.
Need our security documentation or a data-processing agreement? Ask us.