Trust center
Security and data handling
Current controls, intended processing boundaries, and unresolved launch conditions for account data and sensitive quote evidence.
PDF processing is not currently available to users.
The controls below describe the implemented and required design for a controlled ingestion workflow. They do not claim that OCR, provider or tier verification, paid access, or public negotiated cohorts are live.
Capability status
Read the state before the safeguard.
A designed control is not the same as a publicly available capability. This table separates what users can do now from what remains closed.
Available
Supabase authentication
Account creation, sign-in, and password recovery are connected.
Browser only
Manual quote checks
Entered terms remain in the browser and do not require a PDF upload.
Unavailable
PDF processing and OCR
The controlled ingestion path is closed to users pending live verification.
Inactive
Billing and entitlements
No payment flow or automated contributor-access clock is active.
Sensitive evidence
The controlled ingestion boundary
Private source storage and deletion
The controlled design places source PDFs in private Supabase Storage. Browser clients do not receive public object URLs, and raw documents are not published. Source PDFs are scheduled for deletion 30 days after upload. Failed or blocked duplicate uploads are removed sooner when cleanup succeeds; cleanup is a workflow, not an instantaneous guarantee.
Extraction and provider boundary
The pipeline performs an exact byte-hash duplicate check before OCR or model extraction. If no exact match is found and processing is enabled, the PDF is sent to OpenAI for structured extraction with store: false. This configuration does not mean PDF processing is currently open to users.
Under OpenAI's standard API policy, separate abuse-monitoring logs may be retained for up to 30 days, or longer when required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Eligible accounts may be approved for Zero Data Retention or Modified Abuse Monitoring, subject to OpenAI's limitations. For image and file inputs, an image detected as potential child sexual abuse material is retained for manual review even when those controls are enabled.
Derived duplicate evidence
After extraction, quote-specific fields are normalized into server-keyed HMAC semantic fingerprints. Fingerprints, matching records, risk scores, and internal review reasons stay server-only. Contributors receive a generic duplicate result rather than another party's quote details.
Administrative review and unresolved controls
Authorized administrators can review source documents and extracted fields when the workflow is enabled. Provider and tier verification are not live public capabilities. Billing is not active, no paid membership can currently be purchased, and no negotiated cohort is published from contributed quotes.
Privacy explains what may be retained. Methodology explains what evidence could qualify for a future public release.