Security & Trust

AeroSpark reads your contracts. That is the whole product, so it is reasonable to ask exactly what happens to a document after you upload it, who can see it, and what our AI provider is permitted to do with it. This page answers those questions directly.

1. Where your data lives

• Documents — Amazon S3, region us-east-1.
• Application and database — Railway, with a managed PostgreSQL instance.
• Edge and DNS — Cloudflare.

If you connect Google Drive or Microsoft SharePoint, approved documents are also written to your storage, in the folder you nominate. That copy is governed by your own tenant's policies, not ours.

2. Encryption

• In transit — TLS on every connection, to the application and to every third-party service we call.
• At rest — documents are stored with AES-256 server-side encryption, with bucket keys enabled. Customer-provided-key encryption (SSE-C) is explicitly blocked at the bucket.
• Credentials, additionally — Slack and Teams bot tokens and Google refresh tokens are encrypted with AES-256-GCM in the application layer before they reach the database, so they are protected independently of the storage layer.

The document bucket blocks all public access — public ACLs, public bucket policies, and public listing are all disabled.

3. AI and your documents

This is the question we get asked first, so it gets a direct answer.

• Your documents are never used to train AI models. Our AI provider is Anthropic, and this is a contractual commitment in their Commercial Terms, not a policy preference: "Anthropic may not train models on Customer Content from Services."
• Anthropic deletes inputs and outputs within 30 days. That is the standard API behaviour. We send documents inline with each request rather than storing them in Anthropic's Files API, so no longer-retention exception applies to us.
• No human at AeroSpark reads your contracts as a matter of course. Access is limited to the operational circumstances described in section 5.

4. Isolation between customers

Every record — request, contract, policy, audit entry — is scoped to a tenant identifier, and every query is filtered by it. Reviewer and administrator actions in Microsoft Teams re-derive the tenant from a trusted server-side lookup rather than trusting the identifier supplied by the client, because interactive card payloads are client-controllable and can be spoofed. That rule is enforced in code review and covered by automated tests.

5. Access control

• Single sign-on through your existing workspace identity — Slack OAuth or Microsoft Entra. Email-and-password and magic-link sign-in are also available for the web dashboard.
• Role-based permissions — requester, legal, finance, sales management, and administrator. Review and approval actions are gated on role at every handler, on both Slack and Teams.
• Operator access — a small number of AeroSpark staff can reach operational tooling for support and incident response. That surface is restricted by an explicit allow-list which fails closed.

6. Document retention

Documents you submit are retained in your workspace for as long as your account is active, so that your contract register, version history and audit trail stay complete — a register with gaps in it is not much use during a renewal or a dispute.

To have specific documents or an entire workspace deleted, contact [email protected] and we will action it.

7. Subprocessors

These third parties may process customer content on our behalf:

• Anthropic — AI contract analysis and redlining (see section 3)
• Amazon Web Services — document storage (S3)
• Railway — application hosting and managed PostgreSQL
• Cloudflare — edge network and DNS
• CloudConvert — PDF to DOCX conversion, so that PDF submissions can be redlined
• Voyage AI — text embeddings used to compare contract terms against your standards
• Resend — transactional email
• Stripe — payment processing (Stripe does not receive contract content)

These are used only where you enable the corresponding integration:

• Microsoft (Graph) — Teams delivery and SharePoint storage
• Google — Google Drive storage and Gmail intake
• DocuSign — signature workflows

8. How we work

• Recurring security review. The codebase has been through documented security audits in March, May and June 2026, each tracked to individual remediating changes rather than a summary sign-off.
• Prompt-injection defence. Contract documents are untrusted input. Our assistant refuses instruction-shaped input before it reaches the model, and content sent into the redlining pipeline is stripped of instruction markers.
• Least privilege on integrations. Storage integrations request only the scopes needed for the folder you nominate.
• Automated regression gates. Role enforcement, tenant resolution and platform-specific security rules are covered by tests that run on every change.

9. Reporting a vulnerability

If you believe you have found a security issue, email [email protected]. Please include enough detail to reproduce it. We will acknowledge your report and keep you updated while we investigate, and we will not pursue action against good-faith research that avoids privacy violations, data destruction, and service disruption.

10. Contact

AeroSpark.ai Inc.
Security: [email protected]
Legal and privacy: [email protected]

See also our Privacy Policy and Terms of Service.