Privacy.

A firm’s data belongs to the firm. Docenta processes it to do the work the firm asks for and for no other purpose. It is not used to train models, it is not sold, and it is not shared between firms. Every table that holds it carries firm-scoped row-level security in the database rather than checks in the application, so isolation is enforced beneath the code rather than by it.

Access inside a firm follows the firm’s own assignments. A person sees the clients they are assigned to and no others, and the same boundary applies to the agents, which run under a person’s identity rather than above it.

Reads of a taxpayer identifier are recorded before they are answered. Everywhere else in the product, including in agent prompts, memos, audit payloads and logs, an identifier appears as its last four digits.

Docenta is in Beta and is not yet SOC 2 Type II certified. That is stated on the front page as well, because it is the kind of thing a firm should not have to search for.

Retention periods, deletion on termination and breach notification are set out in the data processing agreement. Ask and we will send the current version before you commit to anything.

Sub-processors

These are the third parties that touch a firm’s data, what each one does, what reaches it, and where it processes. The same list is the schedule to the data processing agreement, which binds each of them to the terms Docenta holds to. It changes only with notice to every firm before it does. A firm’s own Microsoft 365 mailbox is the firm’s system, not a sub-processor of ours.

• Anthropic

  The model behind every agent: it reads documents, drafts memos and workpapers in the firm's own templates, and answers research questions against the held authority corpus.

  Document pages and their transcriptions, the firm's templates and instructions, and the facts already on a client's record. Client data is not used to train models, and that is in the contract.

  Processes in: United States.

• Supabase

  Holds the Client Vault: the database, file storage and sign-in.

  Everything the firm keeps in Docenta. Every table carries firm-scoped row-level security in the database rather than checks in the application.

  Processes in: United States (AWS us-east-2, Ohio).

• Vercel

  Runs the application and its durable workflows, and carries the second opinion below to its provider through the Vercel AI Gateway.

  Everything in transit, as the host. Its page analytics record which pages were viewed and carry no client data.

  Processes in: United States (Washington, D.C.).

• TypeSafe AI

  A second opinion on two questions the reader could not decide on its own: which request an arriving document answers, and which form a page is when the split and the printed headings disagree.

  The page's text and the labels of the open requests, with identifiers withheld. Every call carries a zero data retention instruction and is refused when the route cannot honour it. The answer is recorded beside the rule's own and acts on nothing. A firm can switch it off under Agents, Second opinion.

  Processes in: Reached through the Vercel AI Gateway; processing location stated in its data processing agreement.

• Nylas

  Connects the firm's own Microsoft 365 mailbox, so the firm's letters go out from it and the clients' replies come back to it.

  A grant to that mailbox. Docenta reads a message only when it sits on a thread Docenta started or comes from an address recorded on a client; the rest of the mailbox is not read, and nothing in it is ever deleted.

  Processes in: United States.

• Resend

  Sends Docenta's own mail to the firm's staff: access requests and invitations.

  A staff member's name and address. No client data.

  Processes in: United States.

• Sentry

  Error monitoring, so a fault in the code is seen and fixed.

  Stack traces, with request bodies and headers stripped and every string scrubbed before anything leaves the application. Personal data is not sent by default.

  Processes in: United States.