Security and data handling

Public application, protected records

The review workspace is publicly reachable. Case history, document storage, downloads and price-list records require ChatGPT sign-in and server-side ownership verification.

Storage separation

Structured case and audit data are stored separately from document files. Every stored object is namespaced to its authenticated owner and case.

Local OCR

On-device OCR keeps scanned document pixels in the browser. OCR results remain reviewer-controlled and are saved only when the user intentionally saves the case.

Controls

File types and sizes are restricted, downloads use private no-store responses, filenames are sanitized for storage keys, and output remains locked until human review is finalized.

Current boundary

This product foundation does not by itself constitute SOC 2 certification, HIPAA compliance or a carrier security approval.