Security
Your unpublished work stays yours.
You are trusting us with results nobody else has seen. These are the rules we hold ourselves to, and the companies that touch your file on the way.
- 01
Never used for training
Not by us, and not by the model providers that process your file. They run under zero-retention terms and keep nothing after the request.
- 02
Deleted after 30 days
The original file is deleted 30 days after your report is ready. Delete it sooner from your account at any time; the report stays until you delete it too.
- 03
Kept out of logs and analytics
Manuscript text never enters application logs or analytics. We measure page events — upload, scan finished, unlock, payment — not content.
- 04
Encrypted in transit and at rest
TLS between your browser and us, and encryption at rest for files and reports in storage.
Subprocessors
Who touches your file.
We change this list before changing a provider, and note the date here. Model calls go through a single gateway so that no other route can see your manuscript.
| Company | Role | What it sees | Where |
|---|---|---|---|
| Cloudflare | Hosting, file storage, database | Manuscript file, report, account | Global edge; storage region set per bucket |
| EvoLink | Model gateway | Manuscript text during review only | Hong Kong |
| Model provider (open-weight) | Review passes | Manuscript text during review only | To be confirmed |
| Crossref | Reference lookup | Citation strings and DOIs only | United States |
| Stripe | Payments | Email and payment details | United States |
| Resend | Email address, report-ready notice | United States |
Last updated 23 Oct 2026. Questions: security@example.com