Trust & security

Security overview

citeproof is a multi-tenant SaaS product. The controls below are what protect the separation between tenants and the data each one uploads.

• All traffic is encrypted in transit (TLS), with HTTP Strict Transport Security enforced on every response.
• Evidence documents, questionnaires and drafted answers are encrypted at rest.
• Every API request is authenticated against a signed identity token. There are no unauthenticated endpoints that return customer data.
• Multi-factor authentication is required for every account, using an authenticator app (TOTP) — not SMS, which is vulnerable to SIM-swapping.
• Each customer's data is logically isolated at the application layer. That isolation is covered by a dedicated automated test suite that runs before every change can reach production — isolation is a tested property of the system, not an assumption about it.
• Our database has no direct route to or from the public internet.
• All infrastructure is defined as code, version-controlled, and deployed through an automated pipeline. There is no manually configured production system to drift out of a known state.
• Every deploy is gated on an automated test suite and an infrastructure validation step before it can reach production.
• Evidence documents are immutable and versioned, so an answer's citation always resolves to the exact passage it was drafted from.
• Dependencies are scanned for known vulnerabilities on every code change, and a high-severity finding in anything that could reach production blocks the deploy.
• No long-lived AWS credentials anywhere in how citeproof is operated — every deploy and administrative action uses a short-lived, federated identity rather than a permanent key.

Data protection

The documents you upload — security policies, SOC 2 reports, pen test summaries — are yours. They exist in citeproof for one purpose: to draft cited answers to your questionnaires.

• Deleting your account removes your evidence documents, questionnaires and drafted answers from our storage.
• Answer drafting runs on Amazon Bedrock. Your documents are not used to train any underlying model.
• We do not sell customer data, and our sub-processors are not permitted to use it beyond providing the service described below.

Infrastructure

• Hosted on Amazon Web Services, in the United States.
• The database sits in a network with no inbound or outbound path to the public internet — the application is the only thing that can reach it.
• The public site runs on Cloudflare's edge network under a strict Content Security Policy that permits no third-party script, tracking or analytics origins.

Sub-processors

These are the only third parties involved in delivering citeproof. We do not use customer data for any purpose outside the scope below.

Vulnerability disclosure

We welcome reports from independent security researchers. If you believe you've found a vulnerability in citeproof.ai or the citeproof application, we want to hear about it before anyone else does.

How to report

Email hello@citeproof.ai with a description of the issue and, if possible, steps to reproduce it. We will acknowledge your report and keep you updated as we investigate and remediate.

Scope

citeproof.ai and its subdomains, and the citeproof application itself.

Ground rules

• Only interact with accounts and data you own or have explicit permission to test.
• Avoid actions that could degrade the service, destroy data, or affect other users' privacy — testing that would require doing any of these is out of scope for self-directed research.
• Give us a reasonable opportunity to investigate and remediate before any public disclosure.

Safe harbor

We will not pursue legal action against good-faith security research conducted in line with this policy. We do not currently run a paid bug bounty program.

Contact

Security questions, vulnerability reports, or anything else on this page: hello@citeproof.ai. For everything else, see our main contact section.