Where your data lives and who can see it
Hosting, encryption, AI processing and what leaves our servers.
Where it's hosted
AWS Mumbai (ap-south-1). Your documents do not leave India in the normal course of operation.
What AI processing happens
All of it, on our own servers:
- the agreement summary
- clause review
- obligation extraction
- repository search indexing
No document text is sent to OpenAI, Anthropic, Google or any other model provider. There is no third party in the middle. This is usually the first question a legal or security team asks, and the answer is meant to be short.
Encryption
Traffic is TLS-only, with HTTP redirected. Backups are AES-256 encrypted before they leave the server, with a key we do not hold on the same machine.
Access
Permissions are enforced server-side on every request. Within an account, people see their own envelopes plus shared folders. Across accounts, nothing is shared.
Retention
You control how long documents are kept — see retention policies. Purged documents leave the search index at the same time.
Certifications
We hold none yet. SOC 2 and ISO 27001 are audits with a readiness period, and we'd rather say so than imply otherwise. Our security practices are described here and in the Privacy Policy; judge them on their substance.