Security & Privacy
Your documents don't stick around on our servers
PaidWrite is built for documents you don't want sitting on a SaaS dashboard — lien waivers, COIs, W-9s, Safety Data Sheets. Here's exactly how we treat them.
- 1
Documents are deleted as soon as the analysis finishes
The original file is deleted within 30 seconds of upload. The extracted text is held encrypted only while the analysis runs (usually under a minute) and deleted when it finishes or fails; an hourly sweep scrubs anything stale. Only the risk assessment is retained — no names, addresses, or amounts. Sentry never receives document text. (If an operator enables the optional cloud OCR driver, the document image is sent to Google Cloud Vision for text extraction — in transit only, never stored.)
- 2
No PII in analysis results
License numbers, SSNs, EINs, addresses, and signatures are stripped before the analysis is stored. Risk findings reference clauses and statutes, not personal identifiers.
- 3
Encryption in transit and at rest
All traffic to PaidWrite is TLS 1.2+ (HSTS enabled). Database encryption at rest is enabled by default in our managed Postgres, and extracted text is additionally application-encrypted for the short time it exists. Secrets are stored in encrypted environment vars and rotated quarterly.
- 4
Least-privilege access
Production access is limited to two engineers, the admin panel requires MFA, and every administrative action is audit-logged. We do not read customer documents.
- 5
CCPA + GDPR posture
There are no accounts — your data is tied to a per-device identifier. You can export or delete your data at any time in the app (Settings → Export my data / Delete my data) or by emailing privacy@paidwrite.app. We do not sell personal information. California residents can use the "Do Not Sell" link in the footer.
Subprocessors
Vendors that process data on our behalf. We notify customers of material changes 30 days in advance. Full details in the Subprocessor List.
| Vendor | Purpose | Region |
|---|---|---|
| Railway | Application compute (API, LiteLLM proxy, ingestion sidecar) | United States |
| Neon | Postgres database (analysis results, device records, payment records; extracted text encrypted only while an analysis runs) | AWS us-west-2 (Oregon) |
| Google (Gemini) | Primary AI analysis model, via LiteLLM — receives PII-masked text only | United States |
| Groq | Fallback AI inference provider | United States |
| OpenRouter | Last-resort AI model routing (Anthropic models reachable only as a fallback route here) | United States |
| Stripe | Payment processing (Stripe Checkout) | United States |
| CloudAMQP | Hosted message queue for background analysis jobs (identifiers only, no document text) | United States |
| Resend | Transactional email (email-to-scan replies, receipts) and the waitlist audience | United States |
| Sentry | Error monitoring — never receives document text | United States |
| Cloudflare | Website hosting (Pages), waitlist worker + KV, Turnstile bot check, email routing for scan@ | Global edge |
| Google (Analytics, Fonts) | Google Analytics 4 on this website (consent-gated) and Google Fonts | United States |
Reporting a security issue
Email security@paidwrite.app. We acknowledge within one business day. We don't run a paid bug bounty yet — but we credit researchers in our disclosure log when fixes ship.
For privacy requests (delete my data, access my data, opt out of analytics): privacy@paidwrite.app.
Educational reference. Nothing on this page is legal advice. See the Privacy Policy and Terms of Service for binding terms.