Certifications & compliance
SOC 2 Type II
Audited annually by independent firm. Report available under NDA.
GDPR
EU data protection compliant. DPA available on request.
CCPA
California Consumer Privacy Act compliant.
ISO 27001
In progress — certification expected Q4 2026.
Our security principles
Your manuscripts are yours
We never train models on private content. Your drafts, notes and revisions stay yours — period.
Data residency
EU customers have data stored in Frankfurt. US customers in Virginia. Choose your region at signup.
Encryption everywhere
AES-256 at rest. TLS 1.3 in transit. Manuscript uploads use signed URLs that expire in 60 seconds.
Access controls
Workspace access is configured with your team. Publisheds plans include unlimited team seats; contact us to discuss access-control requirements.
Backups & disaster recovery
Hourly snapshots, retained 30 days. RPO < 1h, RTO < 4h. Tested quarterly.
Vendor due diligence
We only use subprocessors that meet our standards. Full list public and updated.
Subprocessors
| Vendor | Purpose | Location |
|---|---|---|
| Hetzner | Primary hosting (EU) | Germany |
| AWS S3 | Backups & cold storage | Multi-region |
| Stripe | Payment processing | US |
| Postmark | Transactional email | US |
| Sentry | Error monitoring | US |
| OpenAI / Anthropic / DeepSeek | LLM inference (opt-in per workspace) | US |
Reporting a vulnerability
Found something? We appreciate coordinated disclosure and reward security researchers. Email [email protected] with details.
PGP key available on request.