Security & Subprocessors

Last updated: June 2026

This page documents how CliniDraft handles data, which third-party processors we use, and our current regulatory compliance status.

Regulatory compliance status

Regulation	Status	Notes
HIPAA (US)	Not covered	No Business Associate Agreement (BAA) is offered at this time. Do not enter Protected Health Information (PHI) or ePHI. All content should be de-identified or fictional before use.
GDPR (EU/EEA)	In progress	CliniDraft is operated by an individual controller. EU personal data is processed on the legal basis of legitimate interest and contractual necessity. Data may be transferred outside the EEA via Standard Contractual Clauses (SCCs) with subprocessors. A DPA for enterprise customers is available on request.
Singapore PDPA	In progress	CliniDraft is developed in Singapore. Hosting is via Railway (SFO region). Singapore-based users' personal data is processed in accordance with PDPA obligations. Data Protection Officer contact: contact@clinidraft.com.
Taiwan PDPA	In progress	Personal data of Taiwan-based users is processed in accordance with the Taiwan Personal Data Protection Act. Data subjects may exercise access, correction, deletion, and portability rights by contacting contact@clinidraft.com.

Subprocessors

We notify customers of subprocessor changes with at least 14 days' notice via updates to this page. Last change: June 2026 (initial publication).

Processor	Purpose	Data transferred	Region	DPA / SCCs
Anthropic	AI text generation (Claude API)	Document prompts & form inputs	United States	Privacy policy
Railway (PaaS)	Application hosting & PostgreSQL database	All user data, documents, account info	United States (SFO)	Privacy policy
Resend	Transactional email (password reset, notifications)	Email address, email content	United States (AWS SES ap-northeast-1)	Privacy policy
Lemon Squeezy	Payment processing & subscription management	Email address, billing name, payment details	United States / Ireland	Privacy policy
NCBI / PubMed	Citation retrieval (NIH public API)	Search queries derived from document text	United States (NIH)	Public API — no personal data transferred
Elsevier Scopus	Citation retrieval (Scopus API)	Search queries derived from document text	Netherlands / United States	Privacy policy

Security practices

• All data in transit encrypted via TLS 1.2+ (HTTPS enforced, HSTS enabled)
• Passwords hashed with bcrypt (Werkzeug, salted)
• Session cookies: Secure, HttpOnly, SameSite=Lax
• PostgreSQL database hosted on Railway with encrypted storage
• API keys and secrets stored as environment variables — never in source code
• Document ownership enforced: users can only access their own documents
• Login brute-force protection: 10 attempts per 15 minutes per IP
• Webhook signature verification (HMAC-SHA256) on all payment events
• Content-Security-Policy and X-Frame-Options headers on all responses
• AI model (Claude) processes prompts but does not retain or train on your data per Anthropic's API terms

Data retention & deletion

• Documents are retained until you delete them or close your account
• You can export all your data (JSON) or permanently delete your account from Account Settings
• After account deletion, all personal data and documents are purged within 30 days
• Payment records held by Lemon Squeezy per their retention policy (typically 7 years for financial records)

Contact & DPA requests

For security disclosures, DPA requests, or data subject rights (access, correction, deletion, portability), email contact@clinidraft.com. We aim to respond within 5 business days.

← Back to home