Security

• Every document, questionnaire and answer is tagged with your company, and the database itself refuses to show it to anyone outside your company (Postgres row-level security). Automated tests check this on every change.
• Our tables are not exposed through any public database API: only our own server reads them, and only on behalf of a signed-in member of your company.
• Files are stored in a private bucket, under your company's id.

• In transit: HTTPS between your browser and Cloudflare, HTTPS again from Cloudflare to our server (strict certificate checks), and TLS from our server to the database.
• At rest: the database and file storage are encrypted by our database provider, Supabase (AES-256).

• The AI steps use Google's Gemini API on the paid tier, which Google does not use to train its models.
• Search results are ranked by Amazon Rerank on AWS Bedrock (us-west-2, Oregon), which receives each question and the passages of your documents found for it. AWS states that Bedrock inputs and outputs are not used to train its models or shared with model providers (AWS Bedrock security).
• We do not train any model on your documents, and we do not use them for anything except your own questionnaires.

• Files are checked for type, size and structure, and scanned for malware, before anything reads them.
• Documents are read in a separate, time- and memory-limited process that is given no credentials and is set up so that outgoing network requests fail.
• If a document contains a password, key or token, we stop: it is held back and never searched or sent to an AI service, and you are asked to upload a version without it.
• Text nobody can see (white on white, tiny print, hidden Word text) is removed, so it can never be quoted as proof.

• You can delete a document, a questionnaire or your whole company in the app at any time. It disappears at once and is erased from our database, file storage and search index within minutes.
• Answers that quoted a deleted document lose those quotes and go back to review; what a person wrote or approved stays. Filled files you already exported are kept until you delete their questionnaire.
• An audit log records who did what (ids, actions and times, never document text) and is kept for one year.
• Backups: our database plan has no backups yet. When we move to Supabase Pro, before our first users' real documents, daily backups are kept for 7 days, so deleted data leaves them within a week.

• Only the founder has access to production systems. Our server accepts key-based logins only; deployments run through a restricted key that can do nothing else.
• Errors are reported to us with document text and request contents removed. We are alerted when a job fails, the queue stops, or a company reaches its spending limit.
• Checks run every night to confirm that the database, file storage and job queue agree, and that no indexed document contains a secret.

If you think you have found a security issue, or you suspect your data was exposed, email hello@citesheet.com with “Security” in the subject. We reply within one business day. If your data is affected by an incident, we tell you without undue delay and within 72 hours of finding out.

See also: subprocessors, data processing agreement, privacy.