Legal Document

Security

What we hold, how it is protected, who else processes it, and what we do not claim.

Effective: August 14, 2026
Table of Contents

1. What We Hold#

Prosei AI stores the case files our users upload. In practice that means some of the most sensitive material a person owns: court filings, medical records, custody evaluations, financial disclosures, and correspondence. We treat that as the defining constraint on how the product is built, not as an afterthought.

2. Encryption#

Data is encrypted in transit using TLS, and encrypted at rest by Google Cloud, where all documents and records are stored. Uploaded files live in Firebase Storage under a per-user path; case records live in Firestore.

3. Access Control#

Access is scoped to the account that owns the data and enforced by Firestore security rules, at the database layer, rather than only in application code. A request for another user's documents is refused by the database itself, so an application bug cannot quietly become a data leak.

Internal access is limited to the smallest number of people needed to operate and support the service.

4. Account Security#

Accounts are authenticated through Firebase Authentication. Time-based one-time password (TOTP) two-factor authentication is available in Settings and we recommend turning it on. Password reset links are single-use and time-limited, and the reset code is stripped from every analytics and advertising path so it cannot leak through telemetry.

5. Sub-processors#

This is the canonical list referenced by Annex II of our Data Processing Agreement.

May process document content:

  • Google (Firebase, Cloud Storage, Cloud Run): infrastructure, authentication, database, file storage, and converting exhibit files to PDF. United States.
  • Vercel: application hosting, so requests transit it. United States.
  • Anthropic: processes document text to produce summaries, answers, and drafts. Does not train models on customer data. United States.
  • Voyage AI: converts document text into numeric embeddings for semantic search. United States.
  • Supabase: stores those embeddings. United States.
  • InfoTrack: transmits filings to courts. Engaged only when a user chooses to e-file, and only for the documents in that filing. United States.

Receive account or diagnostic data only, never document content: Stripe (payments), Resend (transactional email), PostHog (product analytics), Sentry (error monitoring).

6. Tracking and Analytics#

No advertising tag is loaded on any page that displays case documents. Our advertising pixel is restricted to public marketing pages, sign-in, sign-up, and the checkout confirmation page.

Session recordings are configured to hide all on-screen text and all form inputs, and we do not record browser console output or network request bodies. Recordings capture layout, clicks, navigation, and errors, never the contents of a document.

Visitors in the UK, EU, EEA, and Switzerland are asked before any non-essential cookie is set. Anyone, anywhere, can change those choices at any time from Cookie preferences in the footer. Details are in the Cookie Policy.

7. Retention, Export, and Deletion#

Data is retained while an account is active, because it is the substance of the user's case. Deleting a case or an account starts a 30 day grace period during which it can still be restored, after which it is permanently deleted from production systems and the deletion is passed to our sub-processors.

Users can export everything themselves at any time from Settings, as a ZIP containing the original files plus structured JSON.

8. Certifications: What We Have and Do Not#

We would rather you learn this here than during a procurement review:

  • Prosei AI is not SOC 2 certified. Our infrastructure providers (Google Cloud, Vercel, Stripe) maintain their own SOC 2 attestations, which is a different and lesser claim than us holding one. If you need a SOC 2 report from us to proceed, tell us and we will talk about timing honestly.
  • Prosei AI is not a HIPAA covered entity or business associate. HIPAA governs providers, health plans, and clearinghouses, and stops applying to your medical records once you hold them yourself. Health information in the documents our users upload is governed by our Consumer Health Data Privacy Policy instead. We do not describe ourselves as HIPAA compliant, because we are not subject to HIPAA.
  • We have not appointed a Data Protection Officer. Privacy requests go to privacy@prosei.ai and are handled directly.

9. Incident Response#

We maintain a written incident response plan covering detection, containment, assessment, and notification, alongside written information security, data retention, and business continuity policies. Where a breach affects personal data, we notify affected users and the relevant authorities within the timeframes the applicable law requires.

10. Insurance#

Prosei AI maintains Technology Errors & Omissions and Cyber Liability insurance. Certificates are available to partners and enterprise customers on request.

11. Documents#

Our written security, retention, incident response, and business continuity policies are available to customers and partners on request at security@prosei.ai.

12. Reporting a Vulnerability#

If you believe you have found a security issue, email security@prosei.ai. Please include enough detail to reproduce it. We will acknowledge your report, keep you updated, and will not pursue action against good-faith research that avoids privacy violations, data destruction, and service disruption.