Trust & Security
This page describes what is in place today and what is not. We would rather tell you plainly than overstate it.
Last reviewed: October 14, 2026.
How your data is stored
- Our primary database is self-hosted PostgreSQL on a server in Falkenstein, Germany (Hetzner).
- Application compute runs in Frankfurt, Germany (Vercel region fra1).
- Database connections use TLS. Remote database connections require TLS and SCRAM authentication.
- Database backups run every 6 hours and are copied off the database server.
- Integration OAuth tokens are encrypted at the field level before they are stored.
- Traffic between your browser and the platform is encrypted with TLS.
Who can access it
- Each workspace's data is isolated per tenant in the application.
- Two-factor authentication is available for your account.
- An audit log records account and document actions.
What we do not do
- We do not sell your data.
- We do not use your generated documents to train AI models.
To draft a document, the facts you enter are sent to an AI provider. It is listed on our sub-processors page.
Your controls
- Export your data.
- Delete your account and its data.
- Share documents with links that can expire and be password protected.
- Review the audit log of account and document actions.
What we are still building
- An independent security audit. We do not hold a third-party security certification today.
- Encryption of document content at the application layer.
- Point-in-time database recovery.
Security questions or reports can be sent through our contact page.