Anthropic Claude API
Processes product content when AI generation is requested.
Commercial API inputs and outputs are deleted by Anthropic within up to 30 days, subject to its published exceptions.
Security and confidentiality · current posture
Specific controls.
Specific limits.
AIClearline is used for confidential restructures, pay decisions, executive departures, and M&A communication. This is a plain-language disclosure of the controls in place today, the providers involved, and what is not claimed.
Storage and boundaries
One application, named boundaries.
AIClearline stores account and workspace records, program information, generated outputs, approved materials, organizational learning, measurements, and related operational records in PostgreSQL. The production database is Replit-managed on Neon infrastructure.
Data is protected in transit with TLS. Passwords are bcrypt hashed and are not stored in plain text. We do not make a blanket public claim about encryption at rest or key-management arrangements beyond what is documented here.
Application-level tenant isolation. Customer-reachable reads and writes require an authenticated organization and are scoped to that organization. Where a child record also carries an organization identity, both parent and child identities must agree. This is not dedicated or physically separate infrastructure per tenant.
Processors and training
Providers are named, not abstracted.
Each provider operates its own service and controls. Their involvement is shown here instead of being folded into a general statement about cloud security.
Replit-managed PostgreSQL on Neon infrastructure
Hosts the production PostgreSQL database.
The provider-controlled database recovery window is 28 days. This is not a row-level deletion date or physical tenant separation.
Stripe
Processes subscription payments.
AIClearline does not store card details. Stripe may retain records it is legally required to keep.
SendGrid
Delivers transactional email and, where opted in, product or marketing email.
Confidential program content is not copied into routine email. Cleanup is initiated during erasure; provider-side work is asynchronous and best effort.
Google Analytics 4
Optional website and product analytics.
Loaded only after analytics-cookie consent. The active property retains user and event data for two months.
Training policy. Product content is sent to Anthropic only when AI processing is requested. Under Anthropic’s commercial API terms, submitted content is not used to train Anthropic models. AIClearline does not use customer content to train models of its own.
Retention and deletion
Approved boundaries. No automatic content deletion job.
Ending billing is not itself a deletion event. Access expiry and storage eligibility are separate.
ClassScopeApproved period
Customer content
Account, program, generated output, learning, measurement and revision-chain data
Lifetime of workspace
Operational metadata
Terminal or most recent operational records
90 days
First-party visitor measurement
One-way, week-specific visitor digests with no request metadata
90 days
Delivery and feedback metadata
Email-delivery and product-feedback records
12 calendar months
Minimal evidence
Consent, audit, retention-review and deletion evidence
7 calendar years
What deletion does now
A valid account or organization erasure removes product data from AIClearline’s database. Cleanup is then initiated with Stripe and SendGrid. Provider-side work can remain pending or fail and may require manual retry.
What deletion does not mean
Stripe may retain required transaction records. Anthropic may retain API inputs and outputs for up to 30 days. Deleted database records may remain recoverable within the 28-day recovery window.
Access, sharing, and oversight
Named people, organization-owned work.
Ongoing in-product access is for named, authenticated Enterprise members in the organization workspace. Enterprise includes five named practitioners, including the owner. Roles govern access to the shared organization workspace, and the owner manages seats, roles, offboarding, and ownership transfer.
Removing a member invalidates their sessions while preserving organization-owned work, memory, and audit history. AIClearline personnel do not routinely read program content. Production access is limited to what is reasonably necessary for support, investigation, maintenance, or a legal obligation.
Authentication uses secure server-side sessions. AIClearline does not currently claim SSO or mandatory MFA.
Legacy links are a defined exception.
Previously issued bearer links are temporary legacy links with a fixed expiry and cannot be renewed. Anyone holding an active link may read its limited snapshot, so recipients should not forward it.
An inspectable record
Key actions, including Enterprise program access, approvals, generated or downloaded communications, legacy-link revocation, and account or ownership changes, are recorded in audit history for owners to review and filter.
Controls and explicit limitations
What is tested, and what is not claimed.
Internal verification
Internal database-backed HTTP tests cover organization-scoped reads and writes, exports, knowledge-document ownership boundaries, public shares, malformed parent-child records, and selected administrative routes. The current suite passed.
Continuity
Replit-managed PostgreSQL on Neon infrastructure has a 28-day point-in-time recovery window. Per-organization full JSON exports and administrative exports are available. No RPO, RTO, or disaster-recovery SLA is promised here.
Data regions
Customer data is not currently contractually pinned to a customer-selected region. Infrastructure and processor locations are subject to the applicable provider controls and terms.
Independent assurance
No external penetration test or independent assurance report has been completed. AIClearline does not currently claim SOC 2, ISO 27001, or another independent security certification.
Report a concern
Tell us what you found.
For a security issue, privacy question, or deletion request, contact hello@aiclearline.com. We do not publish an invented response SLA.