Trust Center

Uploaded files and the records we create from them are stored with our database and file-storage provider, Supabase. Each file is stored under your own account's folder.

To analyse a document or answer a question, we send its text to our AI provider, OpenAI, through its API. This is why your documents are not end-to-end encrypted: they are decrypted on our servers and processed by OpenAI.

Understify does not train or fine-tune any AI model on your documents. OpenAI's API terms say API data is not used for model training; we have not yet filed a copy of the terms version that applies to our account.

We have not yet confirmed in writing how long OpenAI keeps API requests for our account, whether zero data retention applies, or whether processing can stay in Europe. We will publish the answer here.

The full text we extract from a document is used only by server-side processing. It is not returned by document pages, the API or exports, except in your own data export.

Document text is cleaned of hidden characters before it reaches the model, and quotes the model cites as evidence are checked against your document; findings whose quote cannot be found are flagged. AI output is a proposal for your team to review, not legal advice.

Traffic to Understify is served over HTTPS (TLS), terminated by our hosting provider, Vercel.

Our database provider, Supabase, encrypts stored data at rest (AES-256) and manages the keys. This is the provider's control, not one Understify operates.

Access and refresh tokens for the accounts you connect (Google Drive or OneDrive) are encrypted by our application with AES-256-GCM before they are stored, using a key held outside the database.

Row-level security is enabled on every application table in our database.

We reviewed every table's access policies and database privileges and fixed the gaps we found, so each record is scoped to its owner or organisation and internal tables are reachable only by our servers.

Organisation workspaces have owner, admin, editor and viewer roles. Viewers are read-only.

You can sign in with Google or with a password. Passwords are handled by Supabase Auth, which stores them as bcrypt hashes.

Multi-factor sign-in with an authenticator app (TOTP), required for administrators and optional for members, with one-time recovery codes. The code is built and merged but not yet released, so customers cannot turn it on today. SMS codes and passkeys are not offered.

Requests that change data through our API from a browser are checked for a same-origin source, and cross-site requests are rejected. A short, fixed list of endpoints that are not used with your browser session is exempt from this check and authenticated another way: the Stripe payment webhook (Stripe's signature), scheduled jobs (a server secret), the public API (an API key), and the endpoint that receives your browser's own content-security-policy violation reports (it reads no cookies and changes no data, only logs a redacted summary). Requests that carry no cookies and no browser origin headers, such as server-to-server API calls, are not origin-checked because they cannot use your session.

Webhooks you configure are delivered only to public HTTPS addresses; private and internal network addresses are refused, and redirects are not followed.

Share-link passwords are stored as salted scrypt hashes and repeated wrong guesses are throttled.

If our rate-limit store is unavailable, sign-in, upload and AI endpoints fall back to a strict limit instead of allowing unlimited requests.

A central rate limit covering every API endpoint is not in place yet; some endpoints are limited today.

Payments are handled by Stripe; we do not store card numbers. Stripe's notifications to us are signature-checked.

Each Stripe event is recorded and processed once; a failed event is retried rather than lost.

Application errors are reported to Sentry so we can fix them. Before a report, breadcrumb or log is sent we remove your IP address, cookies, login and API tokens, request bodies, the query part of web addresses (sign-in codes, reset and invite links), share-link tokens, the referring page, email addresses and any user identity. Until this change is released, error reports from the live service can still include your IP address.

Errors are logged in a sanitised form, with database connection strings and passwords removed.

Decision runs, approvals and actions are recorded in a log for your organisation.

Sign-in, two-step verification, billing, share-link, integration, team permission and API key events are recorded in an audit log that the application can add to but cannot edit or delete, except that a scheduled retention job removes events older than 24 months. You can view and export your own events; organisation owners and admins can view and export their organisation's events.

Every code change runs lint, type checks, unit tests, a build check, a dependency audit, a secret scan and a database migration dry run before it can be merged.

Self-service single sign-on is not available. SSO can be requested and is set up manually.

No independent penetration test or external security audit has been completed yet.

Understify holds no SOC 2 report, no ISO 27001 certificate and no other security certification, and has not engaged an audit firm. Our providers' own reports are their assurance, not ours.

We do not run 24/7 security monitoring. Our status page is updated manually.

We do not offer an uptime SLA and do not promise an uptime percentage. Hosting is single-region; multi-region redundancy is not offered.

Database backups are run by our database provider. We have not yet completed a timed restore drill, so we do not publish recovery times.

When you delete a document, its record and stored file are removed from the app straight away. Backup copies expire on our database provider's schedule.

When you delete your account, it is marked as deleted and sign-in is blocked straight away. Your data stays stored, hidden from use, until it is permanently erased.

Deleted accounts are kept for a 30-day grace period so a mistaken request can be reversed, and paid subscriptions are set to end at the close of the billing period. After 30 days, a daily job permanently erases the account: the Stripe subscription is cancelled and the Stripe customer deleted, stored files are removed, connected-account tokens are deleted, and the account and its records are deleted. We keep one log entry with the account id only.

You can download an export of your own account data.

Erasure deletes our copy of connected-account tokens but does not yet revoke them at Google or Microsoft. Slack can no longer be connected; to withdraw an older Slack authorisation, remove the Understify app from your Slack workspace (a manual step). Erasure does not remove data held in Sentry error reports or logs. Stripe keeps payment records it is legally required to keep.

Email security@understify.com with a description and steps to reproduce. Please do not access, change or delete other people's data, and give us reasonable time to fix the issue before telling others. We do not run a paid bug bounty.

Our contact details for security reports are published at /.well-known/security.txt (RFC 9116).