Security posture

Controls in place

Tenant isolation

Row-level security on every tenant table, with an adversarial test suite that seeds two organisations and attempts cross-organisation reads, updates and inserts on each one.

Enforced in: DATABASE

Append-only audit trail

A database trigger blocks update and delete on the audit table — for your administrators and for us.

Enforced in: DATABASE

Full drafting log

Every drafting call is recorded in full — instruction, model, response, timing — and can be reproduced later.

Enforced in: LOG

Multi-factor authentication

Available to every user, and enforced at sign-in once a user has enrolled.

Password policy

A 12-character minimum, with complexity rules and a check against known breached passwords.

GDPR export and erasure

Self-serve: an administrator can export everything the organisation holds, or erase the account with a typed confirmation that cascades through the database and file storage.

Uploaded source files

Pre-construction packs and other uploaded PDFs are purged automatically after 30 days.

Your documents

Remain yours. Export any document, or everything your organisation holds, whenever you choose.