Privacy Policy

Uploaded Power of Attorney documents and rejection letters exist solely in volatile request memory during the analysis process. ConcretePOA never saves uploaded PDF or image files to persistent disk, object storage, or databases. Once the compliance report is generated, the file buffer is freed from memory.

Extracted compliance findings and personally identifiable information (such as principal name, agent name, case title, and user email addresses) are encrypted at the application layer using AES-256-GCM envelope encryption before being stored. Each ciphertext envelope includes an authenticated key identifier and initialization vector, ensuring that even if raw database snapshots are accessed, sensitive data cannot be read without the runtime encryption key.

We partner exclusively with enterprise infrastructure providers that commit to strict security controls:

• Clerk: User authentication, session management, and organization multi-tenancy.
• Neon: Managed PostgreSQL storage with TLS-in-transit and AES-256 at-rest encryption.
• Upstash: Managed Redis for rate limiting and daily spend ceilings.
• Google Cloud Run: Private container execution for the deterministic Python statutory rules engine.
• Anthropic / Google Cloud AI: Stateless AI inference. Customer document data is never used to train foundation models.
• Vercel: Edge hosting, serverless compute, and Content Delivery Network.

Firms and individual users can configure automated data retention policies (30, 90, 365 days, or indefinite). An automated daily retention cron evaluates expired records and permanently purges findings and metadata.

5. GDPR & CCPA Self-Serve Rights

Every user has complete sovereignty over their data:

• Portability: You can download a complete machine-readable JSON export of all your reviews at any time via Account Settings.
• Erasure (Right to be Forgotten): You can permanently delete your entire case history or delete your account with one click.