TRUST & SECURITY

How we handle your data

Plain-language, for whoever on your side has to sign off on a new vendor.

DRAFT — pending legal review; not binding until finalised by counsel. This document was generated to the shape our advocate asked for and has not yet been reviewed or approved. It does not create binding obligations on either party until that review is complete and this notice is removed.

The short version

We built the architecture to need less trust, not just to promise more of it. Where we can avoid touching your raw data at all, we do — field names instead of field values, read-only metadata instead of your infrastructure, your own machine instead of ours. This page describes that architecture as it actually exists in the product, not as marketing copy.

Cloud connectors: metadata only, read-only

Our AWS, GCP, Azure and GitHub connectors authenticate with a read-only role you grant (cross-account STS assume-role for AWS; a read-only OAuth2 token for GCP and Azure) and query configuration and metadata — what a bucket is called, what a repo's branch protection looks like — never the objects or files inside them. A permission failure on one check is caught and skipped; it never escalates into a broader request.

PII inference: field names, never values

When we corroborate what personal data you collect, we look at the names of your data elements — column names, JSON keys, form fields, things like email or credit_card — and never at the values in them. We do not read, store, or reason over your actual personal data to make this inference. Every match we surface is a suggestion a human reviews and confirms; nothing is auto-applied.

The local agent: your files never leave your machine

When you scan an existing folder of documents, the scanner runs as a program on your own machine and reads those files locally. What it sends to our servers is the scan findings — pass/fail status per rule, which required fields were empty, a file hash for evidence — never the file contents themselves. You can read the agent's source and see exactly what leaves your network before you ever run it.

AI drafting: consent-gated, facts-only

Most of our document generation is pure template interpolation — no LLM involved, so there is nothing to consent to. Where we do offer an AI-drafted artefact, it runs only after you explicitly tick a consent checkbox for that request, and what we send to the model is the cited legal rule plus your confirmed, non-PII facts — never raw files or personal-data values. See our DPA for the sub-processor this involves.

Encryption and access

Data in transit is encrypted (TLS). Passwords are hashed, never stored in plaintext. Access to production data is role-based and limited to what a given function needs. Full technical detail is in our DPA, Section 3.

Reporting a concern

If you believe you have found a security issue, email us — we will acknowledge it and investigate promptly.

Need a security questionnaire answered?