Trust and compliance.

No document text in logs

Logs never contain document text, mapping values or passwords. Technical logs (IP address, browser, time) are kept for 90 days.

• Strict sensitive-field filter on every log line
• Token mapping encrypted and stored separately
• Mapping tables: 4 hours (free), 24 hours (paid), longer if you choose

Deploy inside your perimeter

The on-premise edition runs inside your own infrastructure with full feature parity and no calls to external APIs.

• Minimal attack surface
• Runs in air-gapped networks
• Same API as the cloud service

• Self-hosted documentationin the app

Security posture

Built against OWASP ASVS Level 2: parameterised SQL only, HMAC-signed audit chains, two-factor authentication and bot protection. Independent certification is under evaluation.

• Independent security certification: under evaluation
• External penetration testing: planned

• Security questionnaire (CAIQ Lite v4)in the app
• Service status and uptimein the app
• Trust center downloadsin the app

Source transparency

The core engine is available for audit under the on-premise licence. A public changelog and roadmap show what changed and what comes next.

• Changelog published with every release
• Public roadmap
• Security disclosure form for researchers

• Changelogin the app

Documents for your DPO

The privacy policy, terms and AI processing notice are published below. A Data Processing Agreement and standard contractual clauses are provided to business customers on request.

• GDPR privacy policy with controller details
• Data subject rights policy
• International AI processing notice

• All legal documents