Security & Data Handling

Alembic processes sensitive documents — contracts, agreements, financial records. We take that responsibility seriously. This page explains exactly how your data is protected, and where we're honest about what we don't yet offer.

Data in Transit

All connections to Alembic use HTTPS (TLS encryption). This includes browser sessions, API calls, and all communication between our services. Content sent to our AI providers (listed under Subprocessors) is also transmitted over HTTPS.

Data at Rest

• Database — Neon Postgres with encryption at rest. Stores account data, extracted fields, and metadata.
• File storage — Vercel Blob with encryption at rest. Stores uploaded document files.
• Connection credentials — when you connect Gmail, Google Calendar, Google Sheets or another system, the tokens are encrypted with AES-256-GCM before they are stored, using a key kept outside the database.

AI Processing

Documents and conversations are processed using Anthropic, Google's Gemini models (through OpenRouter), OpenAI models (through OpenRouter with zero-retention routing), xAI and TypeSafe, depending on the task. Key facts:

• Under the terms we use them on, none of these providers trains its AI models on your content
• Each keeps what it receives only as its own terms allow — for example, Anthropic and xAI keep API requests for up to 30 days for abuse monitoring, some Google endpoints reached through OpenRouter keep them for up to 55 days, OpenAI requests use zero-retention endpoints through OpenRouter, and TypeSafe keeps nothing
• All API communication is encrypted via HTTPS
• We do not use your documents to train any models — ours or anyone else's

Authentication & Access

• Passwords — hashed with scrypt (via BetterAuth), never stored in plaintext
• API keys — hashed with Argon2, stored only as hashes. Raw keys are shown once at creation and never retrievable again
• Sessions — managed by BetterAuth with secure, HTTP-only cookies
• Google OAuth — available as an alternative sign-in method
• Webhooks — all outbound deliveries are signed with HMAC-SHA256 in the X-Alembic-Signature header, formatted sha256=<hex>. The signed value is timestamp + "." + body, not the body alone, where the timestamp comes from the X-Alembic-Timestamp header (unix seconds). Verify server-side, and reject any delivery whose timestamp is more than five minutes old to defeat replay attacks
• Organization isolation — all data is scoped to your organization. Users in one org cannot access another org's data.
• Webhook egress — outbound webhook URLs are resolved once and the resolved IP is pinned for the request, so a hostname cannot be re-pointed at internal infrastructure between validation and delivery

Subprocessors

These are the third-party services that handle your data:

• Anthropic — AI document processing and conversation (US)
• OpenRouter — routes requests to Google's Gemini models and OpenAI models through zero-retention endpoints (US)
• OpenAI — AI document processing and assistance, reached through OpenRouter with zero-retention routing (US)
• Google — the Gemini models, reached through OpenRouter (US)
• xAI — AI assistance for job briefings and running job work (US)
• TypeSafe — fast AI judgments inside a job, such as which card a document or email belongs to; keeps nothing it receives (US)
• Tavily — web search and page reading when DISTLR or a job looks something up (US)
• Sendblue — text messages (iMessage and SMS): phone numbers and message text (US)
• Vercel — application hosting and file storage (US)
• Neon — managed Postgres database (US)
• Stripe — payment processing (US)
• Resend — sending email, and receiving mail sent to a job’s address (US)
• GitHub — tracking the feedback you send us (US)
• Fastmail — our own support mailbox, if you email us (AU)

Data Deletion

You are in control of your data:

• Delete individual documents, or whole jobs with their documents, files and extracted data
• A workspace owner can delete the whole workspace from Settings. After a seven-day window in which it can be cancelled, its documents, files, jobs, conversations and connections are removed, and its members are anonymised
• Billing and usage records, our security audit logs, and the workspace's activity record are kept after a deletion, as our privacy policy explains. The activity record can include notes and messages from a job's cards; email james@alembictransform.com and we will delete those within 30 days

What We Don't Have Yet

We believe in being upfront. The following are not yet available but are on our roadmap for enterprise customers:

• SOC 2 Type II certification
• HIPAA compliance
• Single-tenant deployment
• On-premise / self-hosted option
• Custom data residency (currently US-only)

If any of these are requirements for your organization, get in touch — we'd like to understand your needs.

Report a Vulnerability

If you discover a security vulnerability, please report it to security@alembictransform.com. We take all reports seriously and will respond promptly.