Security

01Who can see your documents

Your firm's users, and one person on our side: the founder, who has technical access to the database and file storage. The founder opens client documents only to fix a problem you report or to look into a security issue, and each access is logged.

02Separation between firms

Every firm has its own private workspace. Database rules (row-level security) block each firm from any data outside its own workspace, and an automated two-firm test must pass before every release.

03Logins

Multi-factor authentication is required on every client login.

04AI processing

Your documents are read by Claude, an AI model from Anthropic, on your firm's own Anthropic account, billed to you; free first-deal reviews run on ours. Under Anthropic's commercial terms your content is not used to train models.

Anthropic keeps API inputs and outputs for up to 30 days by default; content its safety systems flag can be kept for up to 2 years. Anthropic's no-retention option is not enabled, and AI processing is not restricted to the United States.

05Storage and encryption

Your workspace and files are stored with our database provider in the United States. Our providers encrypt data in transit (TLS) and at rest (AES-256). Each firm's Anthropic key is stored encrypted.

06Backups, export and deletion

The database is backed up daily, and uploaded files get their own nightly backup to a second location. You can export all of your data at any time.

After you cancel, live data is deleted at 30 days and backups age out within 30 more: gone from our systems within 60 days. Nothing is deleted instantly. Anthropic's copy follows Anthropic's policy above.

07Hidden instructions in documents

Documents can contain hidden text meant to mislead AI tools. The AI that reads your documents has no tools: it cannot send, change or delete anything. Every figure is checked against its source page and suspicious documents are flagged. This does not make tampering impossible, so review the brief against the original.

08Data you must not upload

Social Security numbers, government ID numbers, bank or card numbers, and health information. We mask text in the strict SSN format (###-##-####) in the text we extract and tell you when we do; account numbers are never masked and your original files are never changed.

09Service providers

Anthropic (AI processing), Supabase (database, logins, file storage), Vercel (hosting and server code), Cloudflare R2 (file backup) and Resend (login and alert emails; receives email addresses, never documents). Anthropic, Supabase and Vercel each state they hold SOC 2 Type 2 reports. We give clients 30 days' notice before adding a provider that handles their data.

10What we do not have

No SOC 2 report of our own, no independent penetration test of our app, and no cyber insurance. Prompted Ai LLC itself has not been audited. We would rather tell you now than have you find out later.

11If there is a breach

We tell affected clients within 72 hours of becoming aware of it: what happened, what data was affected and what we are doing about it.

12Questions

Email support@dealbasis.ai or write to Prompted Ai LLC, 30 N Gould St Ste R, Sheridan, WY 82801.