Security and data handling

Where your data lives

Your documents are stored on servers in North America. The database is managed Postgres in a US region with automatic backups. Uploaded files are content-addressed and visible only to your account and the operator who administers the service.

What happens during analysis

When analysis requires a language model, the relevant content is sent only to model providers on an explicit allowlist — currently deepinfra, anthropic, openai, google-vertex, fireworks, baseten — with fallbacks to any other provider disabled, restricted to zero-data-retention endpoints, and with data collection denied. In plain terms:

Which provider actually served each call is recorded, so the allowlist is verifiable after the fact, not just configured.

Retention, by plan

Uploaded files, their extracted text, and built deliverables are deleted after your plan's window. Answers, figures and citations stay. Deletions are verified and audited; a purge that fails is surfaced, not swallowed. Internal processing logs expire on a schedule at least as short as the shortest window below.

The page itself

No analytics, no trackers, no third-party scripts, no CDN — every byte, fonts included, comes from this origin. Sessions use Secure, HttpOnly, SameSite cookies. Passwords are scrypt hashes. Stored credentials are encrypted at rest with a machine-local secret. Payments are hosted by Stripe; card numbers never touch these servers.

Code that runs on your data

Analysis code runs in a sandbox that can read only the task's own workspace: no network, no other tenant's files, no way out of its directory. Model-written queries run against an isolated copy of your task's rows only.