Plain-language summary of how we protect your data and what we don't do with it. No fake badges; small team; we're honest about the state we're in and the certifications we don't yet have.
Every card, thread, and ref is keyed by (tenant_id, project_id) at the database level. Application code can't query across tenants — it's a schema-level guarantee, not a "we promise to filter" guarantee.
The Draftlize server runs as stateless containers on Fly.io. No data on disk. Restart, redeploy, regional failover — nothing persists in compute. All state in Postgres + Tigris S3, both encrypted at rest.
HTTP/2 over TLS for every request. Session cookies are HttpOnly, Secure, SameSite=Lax, hashed bearer tokens at rest.
We don't train models on your cards, threads, or refs. Period. The LLM calls go to upstream providers (currently GLM, DeepSeek) under their no-training API agreements.
No third-party error tracking (no Sentry, no Datadog). Errors are stored in our own database in the same tenant boundary. PII never leaves your tenant.
Postgres dumps daily to Tigris S3 bucket, encrypted at rest, 30-day retention. We restore-test monthly. Your data export endpoint pulls from the live DB anytime you ask.
No SOC 2 Type II yet. We're a small team. If your procurement requires SOC 2 before signing, we're not the right tool for you right now. On the 12-month roadmap.
Data Processing Agreement on request — email hi@draftlize.com. Standard EU SCC template, signed within 48h.
Not yet — currently GitHub OAuth + Google OAuth + email magic-link. SSO is on the roadmap when team plans land.
Email to every affected user within 72 hours of confirmation. Public status post within 7 days. Plain-language details of what happened, what was exposed, what we changed.
Email security@draftlize.com. We respond within 48h. No bug bounty program yet (small team), but we'll acknowledge you publicly if the report is real and material.
We'll do a 30-min call walking through the codebase architecture. Email hi@draftlize.com if you're evaluating Draftlize for a meaningful spend and need to inspect.
hi@draftlize.com for general questions. security@draftlize.com for vulnerability reports. Real humans, fast responses.
Start free with $5