Legal

Security

Last updated 2026-06-01

Trust is the entire product at OriginalityScan. This page describes the technical and operational measures we use to keep your account secure and your documents private.

The core promise. We never store your documents. They are processed in isolated environments and deleted as soon as the report is generated. No human reads them. They are never used to train models. They are never shared.

1. How we handle your documents

1.1 Transit

All uploads use TLS with modern cipher suites. Connections that don't meet our minimum TLS standard are rejected.

1.2 Processing

On receipt, your document is placed in an ephemeral processing sandbox isolated from other users. Text is extracted into memory; the original file is held only as long as extraction takes. Similarity cross-referencing and AI classification run against the extracted text.

1.3 Deletion

The instant your report is finalized, all temporary storage of the document and its extracted text is purged. We do not snapshot, log, or back up document content. The only artifact retained is the report itself, scoped to your account, which you can delete at any time.

1.4 No training, no sharing

Your documents are never used to train models — ours or anyone else's. They are never shared with third parties for marketing, analytics, or research. They are not indexed, fingerprinted, or retained for future cross-checking.

2. Account security

2.1 Authentication

Sessions are managed by our authentication provider with rotating signed tokens. Cookies are HTTP-only, Secure, and SameSite. We rate-limit login attempts and lock accounts after repeated failures.

2.2 Password storage

Passwords are hashed using strong, salted hashing and never stored in plain text. Database access alone is not sufficient to read passwords. Key material is managed in a secrets manager separate from the database.

2.3 Multi-factor authentication

We support common MFA methods and encourage you to enable it. Institutional accounts can require MFA via SSO.

3. Infrastructure

Primary hosting on Supabase (PostgreSQL database, authentication, storage) with industry-standard encryption.
Serverless functions for report processing run in isolated, ephemeral environments.
Production secrets live in a managed secrets vault, never in code or environment files committed to source control.
Encrypted backups, retained on a defined schedule, then destroyed.

4. Access controls

Production access is limited to a small number of named engineers. All access is scoped via least privilege and recorded in audit logs. Engineers cannot view document content under any circumstance.

5. Vulnerability disclosure

We welcome reports from security researchers. Please email [email protected] with the subject line "Security report" and include reproduction steps. We acknowledge within 24 hours and aim to resolve critical issues within 7 days.

6. Compliance

We align our operational controls with GDPR principles and applicable data-protection law. Our standard Data Processing Agreement is available to institutional customers on request.

7. Incident response

In the event of a confirmed data incident affecting customer data, we notify impacted users within 72 hours of confirmation, alongside a description of what happened, what data was affected, and what we are doing about it.

8. Contact

For security questions or to report a vulnerability email [email protected].

Questions about this document? Email [email protected]. We reply within one business day.