What happens when this fails, and where your data lives.
The two questions every serious buyer asks. Answered plainly, including the parts we haven't done yet.
Security posture
Walled off in the schema, not filtered in code
Every client's data is isolated at the database level. That was the first schema decision, before any feature work — not a retrofit after a security questionnaire. A bug in application logic cannot leak one client's documents into another's workspace, because the data isn't in the same place to begin with.
Every action, readable by a person
What was read, what was extracted, what confidence each field carried, which rule fired, who approved it, and exactly what was written where. Exportable, timestamped, and written in language your auditor can follow without us translating it.
Nothing writes without your rule
Write access is defined per workflow, per field, per value band — by you. Pilots run with every write gated. Loosening a gate is an explicit change you approve, logged like everything else, and reversible.
It stops; it doesn't improvise
If a system is unreachable or a document is unreadable, the item is held and surfaced — never partially written, never retried into a duplicate. Execution is idempotent, so the same input resolves to the same single outcome however many times it arrives.
Data handling
- Where it lives
- Regional hosting selected per client — EU, US or Middle East — so data residency requirements are met without special arrangements.
- Encryption
- In transit over TLS, at rest on encrypted volumes. Credentials for your systems are stored in a managed secrets service, never in application config.
- Who can access it
- Access is least-privilege and logged. Engineering access to client data happens for a named support reason and is visible in your audit trail.
- Retention
- Source documents and extraction records are retained for the window you specify, then deleted. Audit entries are retained longer by default; you set the policy.
- Model providers
- Extraction runs through commercial model APIs under agreements that exclude training on your data. Which providers are used for your workflow is disclosed in the build scope.
Certification status — stated honestly
We are not SOC 2 or ISO 27001 certified today.
We're building to those controls and working toward formal certification, and we'll publish it here with a date when it's real. If your procurement process requires certification now, tell us on the call and we'll say plainly whether we can meet it rather than wasting a month of your time.