Law firms trust us with material covered by attorney work product and, often, attorney client privilege. This page describes, plainly and specifically, what that trust is built on — no badges for certifications we have not earned.
Infrastructure
AI Zippe Discovery runs on Vercel, Supabase, and the Anthropic API. All three are independently audited and hold current SOC 2 Type II and ISO 27001certifications as of 2026. To be precise about what that means: those are audits of our infrastructure providers, not of AI Zippe Discovery itself. We've done our own internal security review of the application — authentication, access control, and the areas below — and fixed what it found, but a review by the people who built the system isn't a substitute for an independent one. A third-party penetration test, and longer term a SOC 2 audit, are real, tracked next steps, not something we are claiming to have completed today.
- Hosting: Vercel
- Database and account/summary storage: Supabase, built on AWS infrastructure
- AI processing: Anthropic's Claude API
- Payments: Stripe
Encryption
All traffic to and from the site — including your document upload itself — is transmitted over an encrypted TLS connection, enforced via HTTP Strict Transport Security. Everything we do retain (account data, and summaries if you've opted in — see below) is encrypted at rest by Supabase's underlying Postgres infrastructure.
What happens when you upload a document
- Your file is transmitted over an encrypted TLS connection directly to our servers.
- Your document content is sent once to Anthropic's Claude API to generate your summary, over an encrypted connection. Per Anthropic's commercial API terms, that content is not used to train their models and is not retained beyond what's needed to process the request.
- The document itself is never written to our database or file storage.There is no document repository on our side to be compromised — your file exists only for the duration of that one request.
- The generated summary is returned to your account. Unless you've opted in to saved summaries (off by default), nothing from this analysis is retained in our systems once it's returned to you.
- If you have opted in, only the generated summary textis stored, associated only with your account, and can be deleted by you at any time from your dashboard — it only ever stores our AI-generated output, never the source document you uploaded.
Access control
- Every account is isolated by Postgres Row Level Security — one firm cannot query another firm's data, enforced at the database layer, not just in application code.
- Every write to your account (credits, plan, billing status) happens through a narrow, purpose-built database function, never a general-purpose update — there is no path for one user to modify another user's account.
- Payment status is only ever granted by a cryptographically verified webhook directly from Stripe — nothing in the browser can grant itself access.
- Our own team does not have standing access to customer accounts. Any access for debugging purposes requires explicit authorization and is logged.
Application security
- A strict Content Security Policy, generated fresh per request, restricts what can run on the page — mitigates cross-site scripting even if a dependency were compromised.
- Standard security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are enforced on every response.
- An audit log records who ran an analysis and when — not the document content, just accountability.
- Automated dependency scanning flags known vulnerabilities in the software we build on.
Payment security
All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor — the highest level of certification in the payments industry. We never see, transmit, or store your card details.
What we do not do
- We do not use your documents or summaries to train any AI model, ours or Anthropic's.
- We do not sell, share, or disclose client material to any third party.
- We do not retain your original uploaded documents after processing, under any plan.
- We do not require you to sign away rights to your work product. What you generate is yours.
AI transparency
Every summary is generated by AI and is explicitly labeled as requiring attorney review before you rely on it — at the point you download it, not just in a footnote. We would rather you catch an AI mistake than have it reach a deposition. See our FAQ for more on how summaries are built and their limits.
Compliance roadmap
We are a young company built by people who understand what privileged material means to a law firm. Here is where we stand today, not where we hope to be:
- ✅ Encryption in transit and at rest — implemented today
- ✅ Row Level Security multi-tenant isolation — implemented today
- ⬜ Independent third-party penetration test — not yet scheduled
- ⬜ SOC 2 Type I for AI Zippe Discovery itself — not yet started (distinct from our infrastructure providers' own certifications, described above)
We will check a box here only once it's true, and update this page as each milestone is actually completed, not before.
Data Processing Agreement
Firms that require a signed Data Processing Agreement before use can request one at security@aizippediscovery.com. We will provide our standard DPA for review, or work with your firm's template.
Incident response
If you believe you have found a security issue, email security@aizippediscovery.com directly. We will acknowledge reports within 24 hours. In the unlikely event of a data incident affecting customer material, we commit to notifying affected firms within 72 hours of confirmation, consistent with standard breach notification practices.
Questions
Security questions that aren't answered here can be sent directly to security@aizippediscovery.com. We would rather answer a direct question than have you guess.
Last updated 2026-10-19.