Trust
Security
What follows describes the system as it runs today: where your data lives, who can reach it, and what each provider sees. Most of it you can verify yourself — and if your review needs something this page does not cover, write to us and a person will answer.
Where your data lives
Your data — the database and the files we keep for you — is hosted in the European Union.
- Data is encrypted in transit (TLS), including the application's connection to its database; stored files, secrets and logs are also encrypted at rest by the cloud platform that holds them
- Credentials and API keys live in a managed secret store, never in the codebase or in environment files committed to git
Who can reach it
Access to your organization's data is scoped to your organization, and enforced on every request rather than in the interface.
- Sign-in is by emailed link; there is no password to reuse or leak
- Session cookies are HttpOnly and Secure, and mutations reject cross-origin requests
- Account-level actions — billing, members, export, deletion — are restricted to owners
- Engineer access to production is limited to named staff, each with their own keys and accounts, and is never shared
What third parties see
Model providers receive the prompts being measured and the content being drafted; they do not receive your account, your members or your billing data. Card details never reach CitePatch — checkout is hosted by Stripe. The full list is in our Privacy Policy.
- CitePatch does not permit customer content to be used to train third-party models
- Integration credentials you connect are encrypted at rest and used only when you publish a patch
- Exported bundles never contain integration credentials
Getting your data out, or deleting it
Both are self-service, not a support ticket. An owner can request a full export of everything we hold, as one archive, and download it through a link that expires. An owner can delete the organization outright, which removes every project, measurement and patch we hold.