Security & Data Handling

Alembic processes sensitive documents — contracts, agreements, financial records. We take that responsibility seriously. This page explains exactly how your data is protected, and where we're honest about what we don't yet offer.

Data in Transit

All connections to Alembic use HTTPS (TLS encryption). This includes browser sessions, API calls, and all communication between our services. Documents sent to AI providers (Anthropic, Google, OpenAI, or xAI) are also transmitted over HTTPS.

Data at Rest

• Database — Neon Postgres with encryption at rest. Stores account data, extracted fields, and metadata.
• File storage — Vercel Blob with encryption at rest. Stores uploaded document files.
• Integration credentials — when you connect a space to an external system, those credentials are encrypted with AES-256-GCM before they are stored, using a key held in the server environment rather than in the database.

AI Processing

Documents and conversations are processed using Anthropic, Google, OpenAI (outage failover), and xAI. Key facts:

• These providers do not use API data for model training
• Document content is not retained beyond the processing window, except xAI’s default 30-day abuse-monitoring logs (Zero Data Retention is available)
• All API communication is encrypted via HTTPS
• We do not use your documents to train any models — ours or anyone else's

Authentication & Access

• Passwords — hashed with scrypt (via BetterAuth), never stored in plaintext
• API keys — hashed with Argon2, stored only as hashes. Raw keys are shown once at creation and never retrievable again
• Sessions — managed by BetterAuth with secure, HTTP-only cookies
• Google OAuth — available as an alternative sign-in method
• Webhooks — all outbound deliveries are signed with HMAC-SHA256 in the X-Alembic-Signature header, formatted sha256=<hex>. The signed value is timestamp + "." + body, not the body alone, where the timestamp comes from the X-Alembic-Timestamp header (unix seconds). Verify server-side, and reject any delivery whose timestamp is more than five minutes old to defeat replay attacks
• Organization isolation — all data is scoped to your organization. Users in one org cannot access another org's data.
• Webhook egress — outbound webhook URLs are resolved once and the resolved IP is pinned for the request, so a hostname cannot be re-pointed at internal infrastructure between validation and delivery

Subprocessors

These are the third-party services that handle your data:

• Anthropic — AI document processing and conversation (US)
• Google — AI document processing (Gemini) (US)
• OpenAI — AI processing during provider outages (US)
• xAI — AI assistance for the hardest judgment jobs (US)
• Vercel — application hosting and file storage (US)
• Neon — managed Postgres database (US)
• Stripe — payment processing (US)
• Resend — transactional email (US)
• Fastmail — inbound email, if you use a space's email address to send documents in

Data Deletion

You are in control of your data:

• Delete individual documents from any space
• Delete entire spaces and all their data
• Full account deletion is handled by request, not self-serve. Email james@alembictransform.com and we will remove your account and all associated data. A self-serve control is on the roadmap; until it ships we would rather say so than point you at a button.

What We Don't Have Yet

We believe in being upfront. The following are not yet available but are on our roadmap for enterprise customers:

• SOC 2 Type II certification
• HIPAA compliance
• Single-tenant deployment
• On-premise / self-hosted option
• Custom data residency (currently US-only)

If any of these are requirements for your organization, get in touch — we'd like to understand your needs.

Report a Vulnerability

If you discover a security vulnerability, please report it to james@alembictransform.com. We take all reports seriously and will respond promptly.