How your data flows
Plain language, no legalese. This page describes exactly what happens to the security data you upload.
1. You upload data in your browser
The file or pasted text lives in your browser tab's memory. Closing the tab discards it.
2. It is sent to our server over HTTPS — once
When you click “Generate Report”, the data travels encrypted to our API route. It is held in the memory of that single request. We have no database, no file storage, and no logging of uploaded content.
3. Our server sends it to one AI provider for analysis
The data goes directly from our server to the configured AI provider and nowhere else. No analytics services, no third-party middleware, no queues.
4. The report comes back, the data is gone
The generated report is returned to your browser. When the request finishes, the server's copy of your data is released from memory. There is nothing for us to delete, because nothing was saved.
Which AI provider sees the data?
Production: Anthropic (Claude)
API inputs are not used to train Anthropic's models. Data is processed for the duration of the request under Anthropic's commercial API terms.
Testing deployments: Google Gemini (free tier)
On the Gemini free tier, Google may use submitted content to improve its products, including model training. Deployments running in this mode are for evaluation with synthetic or anonymized data only — do not upload real client data to a free-tier deployment.
What we do store — and only if you ask us to
Your account. Email, name and a password hash — what's needed to sign you in and track your plan. Delete your account from the dashboard at any time and it's gone.
Saved reports (opt-in). If you tick “Save the report to my account” when generating, we store the final generated report so you can re-download it from your dashboard. The raw data you uploaded is still never stored — only the finished report text. The checkbox is off by default, and you can delete any saved report (or your whole account) whenever you want.
Support tickets. If you contact us, we keep the name, email and message you typed so we can reply — and nothing else. Your uploaded security data is never attached to them. Ask us to delete a ticket and it's gone.
What we never do
- Store uploaded data, on disk or in any database
- Store generated reports without your explicit opt-in
- Log the contents of your uploads or generated reports
- Run analytics, ads, or tracking scripts
- Share data with any party other than the single AI provider above
Questions about privacy or a data request? Email support@secreportai.com — we usually reply within 2 hours.