Security FAQ
Your vendor review, pre-answered
The security questions every vendor review asks, with our answers ready to go. Grab the summary below and drop it straight into your vendor file.
Do you keep the documents I upload?
Never. Every conversion runs entirely in volatile memory (RAM), so your file is never saved to a disk, a database, or any other kind of persistent storage.
How is my data encrypted?
Everything in transit is protected with TLS 1.3. As for data at rest — there isn't any, since we don't keep anything.
Which third-party sub-processors do you rely on?
Two. DeepSeek handles the AI text structuring — it only ever sees the plain text pulled out of your PDF, never the file itself (see DeepSeek's privacy policy for how they handle it). Supabase covers sign-in and billing records only; your document contents never pass through it.
Are you SOC 2 certified?
Not at this point — a SOC 2 Type II audit is on our roadmap. Worth noting, though: the main danger SOC 2 guards against is a breach of stored data, and our zero-retention design means there's no stored customer data to breach in the first place.
Where does processing actually happen?
Conversions run on Supabase Edge Functions hosted on AWS. The AI structuring step goes through DeepSeek's API (their documentation covers processing locations). Every hop along the way is encrypted.
Do you run advertising trackers?
No. The only tag on the site is Google Ads conversion tracking, which works at the page level rather than following individual users. There's no Google Analytics, no Facebook Pixel, no remarketing cookies, and no fingerprinting.
How long do you retain data?
We don't. A document lives only as long as the conversion itself — usually somewhere between 5 and 30 seconds. Once the finished file reaches your browser, the memory that held it is released.
Is my data used to train AI models?
No — and since we never store your data, we couldn't train on it even if we wanted to; your file exists in memory only while the conversion runs. The structuring step uses DeepSeek's API, governed by their own privacy policy, and what we send is limited to the extracted statement text — never your PDF, and never anything that identifies you.
What would a breach actually expose?
Very little. Because nothing is retained, an attacker who broke into our systems would find no customer financial data waiting for them. The only user data on file is your login — an email address and a hashed password — kept inside Supabase's SOC 2 compliant infrastructure.
Can you sign a BAA or DPA?
Yes — reach out at [email protected] and we'll go over Business Associate Agreements, Data Processing Agreements, or whatever other security paperwork your review requires.
Missing a document you need, or ready to talk through a BAA/DPA? Drop us a line.
[email protected]