Security pages usually list certifications and hope you stop reading. This one tells you where your data physically sits, what enforces the boundary between your tenant and everyone else's, what we have not certified yet, and how to get the diligence pack without a sales call.
How it is built
A policy is a promise that someone will do the right thing. Architecture is the part that holds when they do not.
Every tenant-scoped query passes through a tenant-scoped procedure at the application layer, and every tenant-scoped table carries a row-level security policy at the database layer. The application connects as a role that cannot bypass RLS. One barrier failing is not enough to cross tenants.
TLS 1.2 or higher on every public endpoint. AES-256 at rest for database and file storage, with column-level encryption on the highly sensitive identifiers: SSNs, tax IDs and stored credentials.
Your data is never used to train, fine-tune or improve an AI model, ours or a provider's. Model requests go to provider APIs that do not train on API inputs, and we retain no content for training purposes.
Role-based access control throughout, annual security awareness training for personnel, and least-privilege access to production. Administrative actions are recorded.
Every state change is written to an append-only audit log. That is an architectural decision made early, which is why it covers everything rather than the handful of screens somebody remembered to instrument.
A documented plan with a 48-hour customer notification commitment, and five-year retention of incident records in line with the NAIC Insurance Data Security Model Law.
Data sovereignty
The usual ask from a document AI vendor is that you upload your client files into their storage. We built the other option because a customer refused, and it turned out to be the better design. It is available to every agency, not just the one that asked.
Compliance
A vendor who will tell you what they have not certified is a vendor you can believe about the rest.
Our own audit is on the roadmap and we will say so plainly until it is done. Every critical infrastructure provider underneath us already maintains a SOC 2 Type 2 audit: Vercel, Neon, Clerk, Stripe, Cloudflare and Microsoft.
Written information security program, incident response with defined notification timelines, and the five-year incident record retention the model law requires.
Data subject access, correction and deletion handling, with a Data Processing Addendum available.
SOC 2 and ISO 27001 attestations for our subprocessors are on file and available under NDA.
If your carrier partners or your own risk team need paperwork, ask and we will send it. No sales call in front of it.
We would rather hear it from you than read about it later. For good-faith research that follows our disclosure policy, we commit to:
30 minutes. We'll walk through your real workflows in a tenant set up for you. No slideware.
