Security & Trust

• In transit: All traffic between your browser and TractIt is encrypted using TLS 1.2+ (HTTPS). Documents are uploaded over an encrypted connection.
• At rest: Uploaded files and database records are stored on infrastructure managed by our hosting provider with encryption at rest.
• Clickjacking protection: TractIt cannot be embedded in third-party iframes, preventing the site from being framed to trick you into interactions.

When you run a review, your document text is sent to Anthropic's Claude API for analysis. TractIt uses Anthropic's API tier, which operates under a zero-data-retention agreement: Anthropic does not store your document content beyond the time needed to process your request, and your documents are never used to train AI models. Document content is not retained on Anthropic's servers after the response is returned.

TractIt does not share your documents with any third party for advertising, training, or data enrichment.

• Per-user isolation: Every document, review, and associated record is scoped to the user who created it. Row-level security enforces that you can only read, edit, or delete your own data.
• Admin-restricted actions: Sensitive operations — promoting users, managing templates, generating system content — require an authenticated admin role.
• Authenticated review pipeline: Document reviews verify that the requesting user owns the document before processing begins.
• Public demo isolation: The no-signup demo on our landing page restricts file fetching to trusted storage hosts only, preventing server-side request forgery.

You control how long your documents stay in TractIt:

• Soft delete: When you delete a document from your dashboard, it moves to the Deleted folder and can be restored for up to 30 days.
• Permanent deletion: From the Deleted folder you can permanently remove a document. This purges the document record along with all associated analysis, extracted data, and critical dates from our database.
• Account deletion: You may request full deletion of your account and all associated data at any time by contacting privacy@tractit.com.

TractIt relies on the following trusted service providers to operate. Each is contractually bound to protect your data:

• Base44 — Application hosting, database, and file storage.
• Anthropic — AI document analysis (zero-data-retention API terms; no training on your data).
• Stripe — Payment processing. Card numbers are handled entirely by Stripe and never touch TractIt's servers.

We will update this list before engaging any new subprocessor that handles your document content.

• All backend functions require authentication except a small set of intentionally public endpoints (the landing-page demo and the contact form), each hardened against abuse.
• Security-sensitive code is reviewed for authorization checks, input validation, and injection risks.
• Access to production data is limited to authorized TractIt personnel and is logged.

TractIt is pursuing independent security validation. We are working toward SOC 2 Type II certification. If your organization requires a security review, penetration test summary, or a Data Processing Agreement (DPA) as part of procurement, we are happy to provide one.

If you believe you have found a security vulnerability, please report it responsibly to security@tractit.com. We investigate every report promptly. Please do not publicly disclose suspected vulnerabilities until we have had a chance to address them.