Security & Trust

• In transit: All traffic between your browser and TractIt is encrypted using TLS 1.2+ (HTTPS). Documents are uploaded over an encrypted connection.
• At rest: Uploaded files and database records are stored on infrastructure managed by our hosting provider with encryption at rest.
• Clickjacking protection: TractIt cannot be embedded in third-party iframes, preventing the site from being framed to trick you into interactions.

TractIt sends document content to Anthropic's commercial API for analysis. Under Anthropic's commercial terms, your document content is not used to train Anthropic's models.

Anthropic may retain document content for a limited period for trust and safety purposes. It is not used for any other purpose.

Documents you upload are stored in your TractIt account until you delete them. Deleting a document removes it from your account, and permanently deleting it removes the stored file.

TractIt does not share your documents with any third party for advertising, training, or data enrichment.

• Per-user isolation: Every document, review, and associated record is scoped to the user who created it. Row-level security enforces that you can only read, edit, or delete your own data.
• Admin-restricted actions: Sensitive operations — promoting users, managing templates, generating system content — require an authenticated admin role.
• Authenticated review pipeline: Document reviews verify that the requesting user owns the document before processing begins.
• Public demo isolation: The no-signup demo on our landing page restricts file fetching to trusted storage hosts only, preventing server-side request forgery.

You control how long your documents stay in TractIt:

• Soft delete: When you delete a document from your dashboard, it moves to the Deleted folder and can be restored for up to 30 days.
• Permanent deletion: From the Deleted folder you can permanently remove a document. This purges the document record along with all associated analysis, extracted data, and critical dates from our database.
• Account deletion: You may request full deletion of your account and all associated data at any time by contacting privacy@tractit.com.

TractIt relies on the following trusted service providers to operate. Each is contractually bound to protect your data:

• Base44 — Application hosting, database, and file storage.
• Anthropic — AI document analysis. Processed under Anthropic's commercial API terms. Document content is not used for model training.
• Stripe — Payment processing. Card numbers are handled entirely by Stripe and never touch TractIt's servers.
• Postmark — Inbound email processing for the Deal Inbox, including email bodies and attachments.

Analytics and support

These providers run only on public marketing pages (homepage, pricing, glossary, review landing, and other public routes). They do not load on any authenticated deal page.

• Google Analytics — Traffic analytics on marketing pages.
• Google Ads — Conversion tracking for advertising campaigns.
• LinkedIn — Conversion insight tracking for marketing.
• Chatbase — Support chatbot widget.

We will update this list before engaging any new subprocessor that handles your document content.

• All backend functions require authentication except a small set of intentionally public endpoints (the landing-page demo and the contact form), each hardened against abuse.
• Security-sensitive code is reviewed for authorization checks, input validation, and injection risks.
• Access to production data is limited to authorized TractIt personnel and is logged.

TractIt is pursuing independent security validation. We are working toward SOC 2 Type II certification. If your organization requires a security review, penetration test summary, or a Data Processing Agreement (DPA) as part of procurement, we are happy to provide one.

If you believe you have found a security vulnerability, please report it responsibly to security@tractit.com. We investigate every report promptly. Please do not publicly disclose suspected vulnerabilities until we have had a chance to address them.