Security
What happens to a document you send us.
Plain language, no badges we have not earned. If something here does not match a requirement you have, tell us and we will answer directly rather than point at a policy PDF.
What we do with a document
One thing: produce your findings report. Documents are not used to train models, and they are not resold or republished in any form.
Who sees it
The reviewer working on your submission, and the engineer maintaining the pipeline when a processing failure requires it. Access is by name, not by default.
How long we keep it
During the beta, a submitted document and its report are kept for 30 days after the report is delivered, then deleted. Ask for earlier deletion and it happens the same working day.
Deletion on request
Email hello@aegiscresttech.com with the submission reference. We delete the document and the derived report, and confirm in writing.
Where it is processed
Document processing runs in a hosted environment under our control. Storage and database services used to operate the product are listed below.
Certifications
We do not hold a SOC 2 report, ISO 27001 certification, or a HIPAA business associate agreement. Any page or person claiming otherwise is not us.
Services we rely on
These are the processors involved in operating the product. The list is kept current; if a new processor is added that touches client documents, beta customers are told before it goes live.
- Vercel — hosting for this website and the intake endpoint.
- Supabase — database and file storage for audit records.
- Email provider — used to acknowledge submissions and deliver reports.
Security questions, or a client questionnaire to complete: hello@aegiscresttech.com. We answer these ourselves, in writing.