How we handle your data
No marketing spin. Here's exactly what happens to your files, where your data goes, and what we're still working on.
Files are deleted immediately after analysis. Only AI-generated outputs are saved — and only if you explicitly choose to save the deal.
What happens when you upload a file
1. You Upload
We extract text from your PDF or image. The file is held in memory only.
2. AI Analyzes
Extracted text is sent to Anthropic's API over TLS for analysis.
3. File Deleted
Original file deleted immediately. It never touches our database.
Bottom line: Your original files are never stored. Only AI-generated analysis is saved — and only if you click save.
Encryption
In Transit
All data transmitted over TLS (HTTPS). This applies to file uploads, API calls to Anthropic, and all communication with Supabase and Vercel.
At Rest
Supabase encrypts all stored data with AES-256 encryption. This covers saved deal analyses, account data, and any metadata in our database.
File Deletion
Originals never stored
When you upload a PDF or image, we extract the text in memory and immediately discard the original file. It is never written to a database, never saved to disk storage, and never logged. Once the analysis is complete, the extracted text exists only in the AI response.
If you choose not to save the deal, nothing is persisted at all — the analysis result is discarded when you leave the page.
Extracted Text Storage
Only saved when you say so
Extracted text from your documents is not stored by default. It's sent to the AI, the AI produces an analysis, and the extracted text is discarded.
If you explicitly save a deal, the AI-generated analysis (risk scores, clause breakdowns, recommendations) is stored in your account. The raw extracted text may be stored alongside it so you can reference the original content — but only if you choose to save.
Never Used for AI Training
Anthropic doesn't train on API data
We use Anthropic's API (Claude) for analysis. Anthropic's API terms explicitly state that data sent through the API is not used to train their models. Your contract text is not being fed into future AI models.
We also don't use your data to train any models ourselves. We don't build datasets from user uploads. Period.
GDPR Compliance
Your rights are respected
We comply with GDPR. You can request access to your data, request deletion, correct inaccurate information, or export your data at any time. Email us and we'll handle it.
Our database infrastructure is hosted in the EU through Supabase, which means your stored data stays within EU jurisdiction.
Our Infrastructure
Supabase — Auth & Database
Handles authentication and stores saved deal data. SOC 2 Type II certified. Data encrypted at rest with AES-256. EU-hosted infrastructure.
Row-level security (RLS) is enabled on all database tables. This means queries are enforced at the database level — users can only read, update, or delete their own data. Even if there were an application-level bug, RLS prevents cross-account data access.
Vercel — Hosting
Application hosting and edge functions. SOC 2 certified. Provides DDoS protection, automatic HTTPS, and edge caching. Our serverless functions run here, including the file processing and AI analysis endpoints.
Anthropic — AI Analysis
Extracted text is sent to Anthropic's Claude API for contract analysis. Anthropic does not use API data to train models. Data is transmitted over TLS and is not stored by Anthropic beyond their standard API log retention for abuse monitoring.
What We Don't Do
- ✕Sell your data to anyone — ever
- ✕Use your data for advertising or marketing profiles
- ✕Train AI models on your uploads or saved data
- ✕Store your original uploaded files after processing
- ✕Share data with third parties beyond the services listed above
- ✕Access your saved deals unless you ask us to for support purposes
Being Honest: Limitations
We believe in being upfront. We're a startup, and while we take security seriously, there are things we haven't done yet:
- •We're not SOC 2 certified ourselves. Our providers (Supabase, Vercel) are. We haven't gone through the certification process as a company.
- •No penetration testing yet. We haven't hired a third party to attempt to break into our systems. It's on our roadmap.
- •No formal incident response plan. If something went wrong, we'd handle it — but we don't have a documented, rehearsed procedure yet.
- •Not end-to-end encrypted. Data is encrypted in transit and at rest, but we can technically access stored data on the server side.
- •Small team. We don't have a dedicated security team. Security is handled by the same people building the product.
We're improving this as we grow. If you have specific security requirements, reach out and we'll be honest about whether we can meet them.
Questions?
If you have security concerns or questions about how we handle your data, we'd rather you ask than wonder.
Security questions: hello@termlift.com
Privacy requests: hello@termlift.com
General support: hello@termlift.com
Ready to analyze your first contract?
Your files are deleted immediately after processing. Only the AI-generated insights you choose to save are stored in your account.
Try TermLift free