Security

Effective date: 13 August 2026

This page describes the security measures we actually take. It is a description, not a promise. Nothing on this page is a warranty, guarantee or representation that the Services or your data will be free from unauthorised access, loss or disclosure. No system is secure, ours included. Section 16 of the Terms of Service sets out the legal position.

We would rather tell you exactly what we do and let you judge it than claim to be "secure" and leave you guessing.

What we do with your documents

Pasted text is never written to disk. It is held in memory for the duration of the request and discarded.

Uploaded documents are encrypted at rest using AES-256-GCM, with a unique initialisation vector per document and an authentication tag that detects tampering. The encryption key is held in the application environment, separately from the stored files.

The filename is encrypted too. A legal filename can identify parties and posture on its own, so it is not stored in readable form.

Uploads fail closed. If encryption is not correctly configured, the upload is refused and nothing is stored. There is no fallback that writes an unencrypted document.

Deletion is enforced automatically. Documents are deleted one year after upload by a scheduled process that runs independently of anyone remembering, and you can delete a document immediately at any time.

What leaves our servers

Only the citation being checked. Your document, its text and its filename are never sent to any third party.

Text extraction from Word and PDF files runs on our own servers, in-process. We do not use a third-party document conversion or extraction service.

What is kept out of logs

Document text and citation content are excluded from logs, error messages and error reports by design, and this is enforced by automated tests that fail the build if a document's contents can reach a log line, an error response or a stack trace.

Access

Access to production systems is limited to the operator of the business. We do not read the contents of your documents for product development, feature testing, analytics or marketing — see section 7.4 of the Terms of Service, which binds us to that.

Application security

• Rate limiting on public endpoints, applied per requester and in aggregate
• Limits on upload size, document length and citations per request, with compressed files checked before expansion so that a small file cannot be used to exhaust memory
• Automated dependency and secret scanning
• Independent adversarial review of changes before merge, including deliberately attempting to break our own security tests to confirm they detect what they claim to

Vulnerability disclosure

Report anything you find to namankedia@geppetto.work. Please give us a reasonable opportunity to fix it before disclosing publicly, and do not access or retain other people's data while testing.

We do not currently offer monetary rewards. We say so plainly rather than implying a bounty that does not exist. We will credit researchers who want credit.

What we do not claim

We hold no security certifications. We are not SOC 2 audited, not ISO 27001 certified, and have not undergone a third-party penetration test. We are a very small operation. If you need a vendor with formal certifications, we are not that vendor today, and we would rather you knew that before you signed up than after.

Planned improvements

We publish these so you can see the gap between where we are and where we intend to be. They are statements of intent, not commitments, and no date is promised.

• Moving the document encryption key into an external key management service, so that a compromise of the application does not by itself yield the key and stolen storage remains unreadable
• Independent security review

Questions: namankedia@geppetto.work