1. The one-paragraph version
Your documents are not stored. Text you submit is processed in memory to produce a verification result and is not written to disk as a document. What is retained, for you, is the verification record: the structured result. For a citation check that is the citations found, their positions in your text and normalized forms, their labels and evidence, and no surrounding text. For a quotation check it also holds the quoted passages you asked us to verify and the matched public-opinion text. Audit and billing entries sit alongside. That record exists so that an identical retry is not billed twice, and so that you can retrieve your verification record later, including to satisfy a court’s AI-disclosure or verification order. We never train models on your content.
2. What we store, precisely
| Data | Stored? | Where | Retention |
|---|---|---|---|
| Submitted document or brief text | No | processed in memory | — |
| Fingerprint of the request arguments (SHA-256), for idempotency | Yes | ledger | with the verification record |
| Verification record: citations found, their positions and normalized forms, labels, evidence, coverage, audit ids; for quotation checks the quoted passages and matched opinion text | Yes — the product's compliance artifact | billing and audit database, on our hosting provider's volumes and snapshots | 90 days live, then encrypted object storage operated by our hosting provider; retrievable through the verification-log API for as long as you hold access; deletion on request* |
| Account (email, authentication id, Terms-acceptance version and time) | Yes | authentication provider and ledger | life of the account |
| Billing and usage rows (tool, credits, state, timestamps) | Yes | ledger (rows are updated for state changes, never deleted) | retained; financial records, at least seven years* |
| Request log (proxy address, method, path including any query string, status) | By the hosting provider, not by us | Fly.io platform logs | the provider's standard short retention; we store no IP addresses and export nothing |
| Case-law corpus | Yes (public court records) | our index | not applicable — public data |
* Deletion requests, sent to support@verdict.io from the account’s email address, are honored by hand: the verification record’s content payload is removed from the live database and the archive, and the financial row (amounts, timestamps, hashes) is kept where billing-record or legal obligations require it. Our hosting provider’s volume snapshots taken before a deletion age out on its own schedule; they hold the same rows and nothing more.
3. What never happens
- No model training on Customer Content, ever.
- No document persistence: submitted text is not written to disk, object storage or backups as a document.
- No third-party disclosure of content: lookups against public legal-data sources transmit only a citation core (for example “347 U.S. 483”), citation components (title, part, section) or a case identifier, never your document, quotes or facts. Quotation matching and date reconciliation run entirely against data we hold locally.
- No AI model provider: nothing is sent to any large-language-model service; the Service has no such dependency.
- No cross-tenant access: every verification record is bound to the authenticated account that created it; retrieval by another account is rejected at the query layer, and that rejection is covered by automated tests.
4. Nuance worth noticing
A verification record necessarily derives from your document: it contains the citation strings we found and, when you use quote checking, the quoted passages you asked us to verify, with short surrounding excerpts from the public opinion (not from your document) as evidence. If your threat model requires that even derived citation lists never persist, contact us about ephemeral processing before use.
5. Subprocessors
| Provider | Purpose | Content exposure |
|---|---|---|
| Fly.io | API hosting, managed Postgres with volume snapshots, Tigris object storage (the archive) | verification records at rest and in backups; documents in memory only |
| WorkOS | authentication and the Terms-acceptance record | email, authentication identifiers and the acceptance record only, never content |
| Stripe | payment processing | billing only, never content |
| Vercel Inc. | hosting for verdict.io (public pages and console); cookieless analytics on the public pages | the console relays API responses in memory and stores nothing; no content reaches analytics |
| Google LLC | Google Analytics on the public pages only, under your consent choice | page paths without query strings, referrer, device class; never content, never the console |
| Public case-law recency service (a non-profit legal-data provider) | recency lookups for citations our own corpus cannot resolve, behind a daily cap | the citation core only |
| eCFR (ecfr.gov, U.S. Government) | federal regulations by citation | citation components only: title, part, section, appendix |
| Caselaw Access Project (Harvard Law School, static.case.law) | opinion text by case id, cached locally | a case identifier only |
Corpus ingestion downloads public bulk data from government and non-profit sources; no customer data is involved. Cloudflare provides DNS for our domains only and never sees traffic. Changes to this list will be posted here at least 14 days in advance.
6. Security measures
Encryption in transit everywhere; OAuth 2.1 with audience-bound tokens (a token minted for another service is rejected); API keys verified in constant time; per-account rate limits; a billing and audit ledger whose rows are never deleted, with server-enforced idempotency; per-tenant query scoping with regression tests; a fingerprinted tool manifest (SHA-256 fingerprints of every tool’s description and schemas) published at a well-known URL so MCP clients can detect changes; secrets in the platform secret store, rotated on exposure.
7. Questions
Security: security@verdict.io. Privacy and everything else: support@verdict.io.