Trust
Security
What follows describes the system as it runs today: where your data lives, who can reach it, and what each provider sees. Most of it you can verify yourself — and if your review needs something this page does not cover, write to us and a person will answer.
Where your data lives
Everything CitePatch stores runs on Google Cloud in europe-west1 (Belgium). Nothing is stored outside the EU.
- Data is encrypted in transit (TLS) and at rest by the platform, including the database and object storage
- Credentials and API keys live in Google Secret Manager, never in the codebase or in environment files committed to git
- Each service runs as its own least-privilege identity; the application cannot read secrets belonging to another service
Who can reach it
Access to your organization's data is scoped to your organization, and enforced on every request rather than in the interface.
- Sign-in is by emailed link; there is no password to reuse or leak
- Session cookies are HttpOnly and Secure, and mutations reject cross-origin requests
- Account-level actions — billing, members, export, deletion — are restricted to owners and recorded in an audit log you can read
- Engineer access to production is limited to named staff, uses Google Cloud identity, and is not shared
What third parties see
Model providers receive the prompts being measured and the content being drafted; they do not receive your account, your members or your billing data. Card details never reach CitePatch — checkout is hosted by Stripe. The full list is on the subprocessors page.
- CitePatch does not permit customer content to be used to train third-party models
- Integration credentials you connect are encrypted at rest and used only when you publish a patch
- Exported bundles never contain integration credentials
Getting your data out, or deleting it
Both are self-service, not a support ticket. An owner can request a full export of everything we hold, as one archive, and download it through a link that expires. An owner can delete the organization outright, which removes every project, measurement and patch we hold.