Security, retention and limits

Isolation

Each workspace is a tenant: separate storage prefixes, row-level isolation in the database, separate encryption context. No API can address another tenant's data.

Encryption and hosting

Google Cloud, asia-east1 by default (EU/US on request). TLS 1.2+ in transit; Google-managed encryption at rest. Cloud SQL with point-in-time recovery; Cloud Storage with lifecycle deletion.

Retention

Default 90 days per workspace, configurable 30–730. Deletion requests executed within 30 days; backups roll off within 35. Usage ledger and audit log retained 2 years; billing records 7 years.

Access

SSO (Google, Microsoft) on Group and Enterprise; magic-link email otherwise. Roles: preparer, reviewer, auditor (read-only, time-boxed). Our operational access is limited to named staff under Google Cloud IAM with short-lived credentials and is logged.

What model providers see

The unmatched item, the candidate document excerpts and relevant clauses — for the request in hand, under enterprise terms that exclude training. With BYOK the request goes to your provider account.

Deliberate limits

• Never writes to customer systems.
• Never posts entries; drafts only.
• Never resolves handwritten amendments or chooses between contradictory documents.
• Never explains without a citation.
• Does not assert that a balance is correct; it assembles evidence and makes gaps visible.

Reporting a vulnerability

[email protected]. Acknowledged within two business days.

Policies

Privacy policy, terms, DPA and sub-processor list are published once at carnegieintel.com and apply to this product.