Law firms trust us with material covered by attorney work product and, often, attorney client privilege. This page describes, plainly and specifically, what that trust is built on — no badges for certifications we have not earned.

Infrastructure

AI Zippe Discovery runs on Vercel, Supabase, and the Anthropic API. All three are independently audited and hold current SOC 2 Type II and ISO 27001certifications as of 2026. To be precise about what that means: those are audits of our infrastructure providers, not of AI Zippe Discovery itself. We've done our own internal security review of the application — authentication, access control, and the areas below — and fixed what it found, but a review by the people who built the system isn't a substitute for an independent one. A third-party penetration test, and longer term a SOC 2 audit, are real, tracked next steps, not something we are claiming to have completed today.

Encryption

All traffic to and from the site is encrypted in transit (TLS, enforced via HTTP Strict Transport Security). Data at rest is encrypted by Supabase's underlying Postgres infrastructure.

What happens to your documents

Uploaded documents are sent directly to Anthropic's API to generate your summary and are never written to our own database or file storage — there is no document repository on our side to be compromised. Anthropic's commercial terms state customer content is not used to train their models.

Separately, if your firm opts in, you can save the generated summariesthemselves so your team can revisit them later from the dashboard — this is off by default, per-firm, and only ever stores our AI-generated output, never the source document you uploaded. Saved summaries are isolated to your firm's account at the database layer (the same Row Level Security described above), kept indefinitely, and deleted one at a time, only when you choose to delete them — there is no automatic expiration. Turning the setting off stops new summaries from being saved; it does not delete anything already saved.

Access control

• Every account is isolated by Postgres Row Level Security — one firm cannot query another firm's data, enforced at the database layer, not just in application code.
• Every write to your account (credits, plan, billing status) happens through a narrow, purpose-built database function, never a general-purpose update — there is no path for one user to modify another user's account.
• Payment status is only ever granted by a cryptographically verified webhook directly from Stripe — nothing in the browser can grant itself access.

Application security

• A strict Content Security Policy, generated fresh per request, restricts what can run on the page — mitigates cross-site scripting even if a dependency were compromised.
• Standard security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are enforced on every response.
• An audit log records who ran an analysis and when — not the document content, just accountability.
• Automated dependency scanning flags known vulnerabilities in the software we build on.

AI transparency

Every summary is generated by AI and is explicitly labeled as requiring attorney review before you rely on it — at the point you download it, not just in a footnote. We would rather you catch an AI mistake than have it reach a deposition. See our FAQ for more on how summaries are built and their limits.

Reporting a concern

If you believe you have found a security issue, email help@aizippediscovery.com and we will respond directly.

Last updated 2026-08-27.