Privacy policy

Who this policy covers

This policy applies to citeproof.ai and the citeproof application: anyone who visits the marketing site, signs up for a trial, or uses the product to manage security questionnaires and evidence. It does not apply to a customer's own internal systems, or to how a customer's own end users are handled outside citeproof.

citeproof is a business-to-business product. If you use citeproof through your employer or another organization, that organization is typically the one making decisions about what data it uploads; this policy describes how citeproof itself handles that data once it's in our systems.

What we collect

• Account information — the email address you sign up with, authenticated through Amazon Cognito. We never see or store your password ourselves; Cognito handles authentication directly.
• Organization/tenant information — the workspace you belong to and your role within it (owner, editor, or viewer).
• Content you upload — evidence documents (for example, security policies, SOC 2 reports, penetration test summaries), questionnaires, and the answers citeproof drafts or you edit.
• Usage and audit data — an append-only log of actions taken in your workspace (uploads, approvals, exports), and application logs retained for 90 days for operating and debugging the service.

We do not collect payment card details directly — if and when citeproof introduces paid billing, that will go through a payment processor that never passes card numbers through our systems.

How we use it

We use the data above only to operate and improve citeproof:

• To authenticate you and enforce that you can only access your own organization's workspace.
• To extract questions from uploaded questionnaires and draft cited answers from your uploaded evidence.
• To detect when an evidence document has been superseded, so answers citing outdated material are flagged.
• To operate trial accounts — including automatically restricting and, eventually, deleting an inactive trial's data (see Retention and deletion).
• To respond to support requests and, if you've told us it's okay, to contact you about the product.

We do not sell your data, and we do not use it for advertising.

AI processing

Drafting an answer involves sending the relevant portion of your uploaded evidence and the question text to Amazon Bedrock, an AWS AI service, to generate a draft and to compute embeddings used for retrieval. None of your content is used to train any underlying AI model — Bedrock does not train on customer prompts or content, by AWS's own service terms. Every drafted answer is required to cite a passage that was actually retrieved from your evidence; a citation that doesn't resolve to real, retrieved text is rejected rather than shown to you.

Who we share it with

We do not sell customer data. citeproof uses two sub-processors to deliver the service, and neither is permitted to use your data beyond that purpose:

We'll update this list, and this page, if that ever changes — see Changes to this policy.

We may also disclose data if required to by law, or to protect the rights, property, or safety of citeproof, our users, or the public — the same narrow exception most services carry, not a general license to share.

Retention and deletion

Trial accounts. If a trial workspace goes inactive, it's automatically flipped to read-only after 3 days and its data is deleted after 8 days of inactivity. This is an automated process built into the product, not a manual step someone has to remember to perform. Closing your account at any time triggers the same deletion — every storage location your data could exist in (uploaded documents, extracted questions, drafted answers) is swept and removed.

Paid accounts. Retention terms for a paid subscription are set out in the applicable service agreement.

Backups of the underlying database are retained for 7 days for disaster-recovery purposes, then age out automatically — a deleted account's data does not persist indefinitely in a backup either.

Security

Full detail on how citeproof protects data — encryption, tenant isolation, infrastructure, and how to report a vulnerability — is on our Trust & Security page, held to the same "say what's actually true" standard as this one.

Where data is processed

citeproof's infrastructure is hosted in the United States. If you're accessing citeproof from outside the United States, your information will be transferred to, stored, and processed in the United States. If your organization has specific requirements around international data transfers, contact us and we're happy to discuss them.

Cookies and tracking

The citeproof.ai marketing site runs under a strict Content Security Policy that does not permit third-party analytics, advertising, or tracking scripts — there is no ad pixel, no third-party analytics tag, and no cross-site tracking cookie on this site. The application itself uses only the session cookies necessary to keep you signed in.

Your rights and choices

You can ask us to access, correct, export, or delete the personal data we hold about you by emailing hello@citeproof.ai. If your data was uploaded by your employer's workspace rather than by you directly, we may need to direct the request to that organization's workspace owner, since they control what's in it.

Account owners can independently export their reviewed answers at any time, and can delete their organization's account and data without waiting on us — both are built into the product itself rather than requiring a support request.

Children's privacy

citeproof is a business tool and is not directed at, or knowingly used by, children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

If we make a material change to how we handle data, we'll update this page and change the effective date above. We don't backdate changes or apply them retroactively to how data already collected was handled.

Contact

Questions about this policy, or a request about your data: hello@citeproof.ai. For security reports specifically, see our vulnerability disclosure process.