Privacy commitment

Manuscripts are visible only to your own account

Row-level security (RLS) is enabled on every manuscript, reference, and library table, so the database checks the requesting account on every query. Another user's manuscript returns zero rows.

Measure: Supabase RLS on every table · cross-account access regression tests run in CI on every change

Manuscript access through the API is logged for audit

Manuscript reads through the service API are logged statement-by-statement by the database's audit extension (pgAudit), and in-app actions such as exports and AI calls are written to a separate audit log table.

Whether auditing stays enabled is verified from outside (GitHub Actions) every 6 hours by a read-only account. An administrative role could turn auditing off, but a disabled state would show up in this check.

Operational access by our database hosting provider (Supabase) is outside the scope of this audit.

Measure: pgAudit read logging · audit_logs table · external audit-watch monitor

Storage is always encrypted at rest

Disks for the database and file storage are encrypted with AES-256 by our hosting providers (Supabase, Vercel). Exported PDFs and EPUBs are kept in private storage and can only be downloaded through signed URLs that expire.

The body text of items saved in your research library is not additionally encrypted. Evidence injection, full-text search, AI research and bibliography extraction all rely on plaintext access, so library bodies are protected only by the disk encryption above, account isolation (RLS) and auditing.

Measure: Supabase/AWS disk encryption · Vercel Blob private storage + signed URLs (10-minute default)

AI processing is configured not to retain your manuscript

The AI features we provide route requests to providers through the Vercel AI Gateway, and every request forces a Zero Data Retention option. We do not use models that don't support this option.

Anthropic, OpenAI, and Google's paid APIs contractually do not use input to train models. For Google, we use only the paid Gemini API path, not a free tier where prompts could be used for training.

We do not store the body of AI requests or responses. What we store is metadata only — model, token counts, and cost.

Research or generation run with an API key you registered yourself does not go through the Gateway. Data retention and training use follow that provider's own terms and your account settings.

Measure: AI Gateway zeroDataRetention enforced · list of usable models pinned from measured results (2026-09-11) · ai_requests stores metadata only

External connections

When you connect an external AI tool such as Claude over MCP, it can only read manuscripts with the permissions of the account you're logged in as, and every call is written to the audit log. You can disconnect at any time.

Measure: Supabase OAuth 2.1 + RLS-scoped token · audit_logs mcp.tool_call