How We Protect Your Data
Security is not an afterthought at Attestly. We built client-side isolation, document-level authorization, and anti-injection guardrails into the core codebase.
Client-Side In-Browser Ingestion
When you upload a buyer workbook (.xlsx, .xls, .csv), the spreadsheet is parsed strictly inside your web browser using WebAssembly and client-side JavaScript. Only the extracted question text strings leave your machine to match against policy evidence passages. Raw spreadsheets are never stored on our servers.
Document-Level Authorization & Multi-Tenant Isolation
Our Appwrite backend enforces document-level permissions on every database record. Each founder's project document is bound strictly to their authenticated Appwrite user ID with discrete read, update, and delete access. Tenant A is mathematically blocked from inspecting or querying Tenant B's evidence.
Encryption Standards
All communications between your browser, our application services, and external APIs enforce modern TLS 1.3 encryption. Persistent records stored in Appwrite Cloud (Frankfurt, EU region) are encrypted at rest using AES-256-GCM.
Prompt Boundary Containment & Anti-Injection
Untrusted text from uploaded questionnaires is bounded with strict delimiters and character caps before being evaluated by model endpoints. Prompts explicitly instruct the model never to follow instructions embedded in questionnaire questions, preventing adversarial prompt injection attacks.