How your clients’ documents are handled — verifiably

Model and database keys never reach the browser.

All provider keys are server-side environment secrets; nothing sensitive ships as NEXT_PUBLIC_*. The public /api/ai/health probe reports configuration presence as booleans only.

Locked work product cannot leak to an unpaid session.

Previews are server-side projections — the full report/checklist is never serialized to a client that has not unlocked it. Verified in the June 2026 adversarial audits.

The database denies by default.

Every table runs row-level security with no client policies plus explicit privilege revokes — only the server (service role) reads or writes, with authorization enforced in the application layer.

Access codes are never stored in recoverable form.

Codes are stored as SHA-256 hashes; the plaintext exists once, in the purchase email. Sessions and trial cookies are HMAC-signed with constant-time comparison.

Your document is handled as data to analyze, not as instructions.

Uploaded content rides in the user turn behind an immutable injection-guard system rule: document text is data to analyze, never instructions — an injection attempt becomes a red-flag finding.

Every artifact link is unguessable and brand-scoped.

Capability IDs are 26 hex characters of CSPRNG output; reads are scoped to the issuing brand; shares use one-way HMAC handles that never expose the underlying capability ID.

Payments cannot silently fail into paid-but-not-delivered.

Webhook signatures are verified, grant-write failures return 5xx so the processor redelivers, refunds and chargebacks revoke access, and single-use codes consume atomically.

What we store

Documents you submit for review or drafting, the reports and drafts the engines produce, and the adjudication trail—bound to your authenticated account and tenant. Explicit shares are limited, expiring, recipient-bound, and revocable.

Where it lives

United States infrastructure: Vercel (hosting/compute) and Supabase (database, region us-east-1 — verified against the live project). No EU residency is offered today, and we do not imply otherwise.

Retention & deletion

Active matter files stay available to the authorized account. Closed matters follow the published seven-year schedule; the signed-in account privacy center provides a data export and a seven-day, cancellable deletion request. Eligible requests complete within 30 days. Legal holds, payment disputes, and required firm-data transfers pause deletion; support@draftcounsel.io handles assisted requests.