Trust
Security and data handling
What runs where, who processes what, and what we deliberately do not do. Written in the same register as our methodology page: stated plainly, including the things we don't yet have.
Architecture
- The service runs on Google Cloud Run (us-central1) behind Cloudflare's edge; all traffic is TLS end to end.
- Account data lives in a managed PostgreSQL instance; research artifacts (corpora, reports, proof records) live in Google Cloud Storage, namespaced per tenant — every artifact path is scoped to your tenant identity, and cross-tenant access is structurally impossible through the application.
- Payments are processed entirely by Stripe; we never see or store card numbers.
- Sessions are cookie-based over HTTPS; the beta is invitation-only.
What we do with your research
- Your research questions and commissioned reports are private by default. A report becomes public only when you explicitly mint a share link, and you can revoke that link at any time.
- We do not train models on your data. The model providers we use process your content to produce your report and are bound by API terms that exclude training on API traffic.
- Analytics on the marketing site are cookieless (Cloudflare Web Analytics); the funnel counters we keep are aggregate counts, not user profiles.
Subprocessors
These providers process customer data on our behalf. This list is the complete set; we will update this page before adding to it.
| Provider | Purpose | Data it sees |
|---|---|---|
| Google Cloud | Hosting, database, artifact storage | All service data, at rest and encrypted |
| Anthropic | Research and drafting models | Research questions, source texts, drafts |
| OpenRouter → OpenAI | The independent audit judge | Report sentences + cited evidence |
| Tavily and search providers | Source discovery | Search queries derived from your question |
| Stripe | Payments | Billing details; never research content |
| Cloudflare | Edge network, cookieless analytics | Traffic in transit |
| Resend / Google Workspace | Transactional email | Your email address, run status lines |
Where we are honest about maturity
We are an early-stage company in an invitation-only beta. We do not yet hold a SOC 2 attestation; if your procurement process requires one, tell us — that demand signal directly sets its priority. A data processing agreement is available on request at info@siderealintelligence.com. Security reports to the same address reach the founder directly.