Is my data safe with DocsHound?

What we store

We hold the minimum we need to run your hound and show you what's happening. Four kinds of data, and why we keep each one:

Encryption & hosting

Here's how your data is protected while it moves, and where it sits.

• In transit: every connection to DocsHound and your embedded hound runs over HTTPS/TLS, so traffic between browsers, our service, and our providers is encrypted.
• At rest: stored on managed infrastructure; encryption at rest is being confirmed per store.
• Hardened cloud hosting: the application runs on dedicated cloud infrastructure behind active firewalls; this website is served by Cloudflare.

AI processing

Your hound's answers are generated by a large language model. Here's what that means for your data.

• Responses are generated through the API of a leading AI model provider (currently OpenAI).
• Your data is not used to train AI models. Our AI model provider does not train on data sent through its API, so your content and conversations stay yours.

Access controls & least privilege

We limit who can touch your data — and we keep that circle small.

• Access to your data is restricted to the people and systems that genuinely need it to run and support the service — least privilege by default.
• Your workspace is scoped to your account; your hounds, content, and transcripts aren't shared with other customers.
• On Team and Scale, you get team seats; SSO is available on Scale for centralized sign-in.

Sub-processors

A short, honest list. These are the third parties that process data on our behalf to deliver DocsHound:

• OpenAIGenerates your hound's AI responses. Does not train on data sent through its API.
• CloudflareServes this website; network delivery and DDoS protection.
• SupabaseDatabase.
• HyperDXApplication logging.
• PostHogProduct analytics and session replay.
• Model provider(s)Generates responses; under our agreements, not used for training.

Data retention & deletion

You stay in control of your data for as long as you're with us — and when you leave.

• Export: you can request an export of your account's data.
• Delete on request: email us at any time and we'll delete your data.
• On cancellation: when your account is terminated, your data is deleted within one month, apart from records we're required to keep for legal or billing reasons.
• To export or delete, write to [email protected].

Compliance posture

We'd rather be straight with you than over-claim. Here's exactly where we stand — what's our practice today, what we're building toward, and what's available if you ask.

• Our approachPrivacy (GDPR / CCPA): we follow the core principles — store only what we need, be transparent about it, and honor export and deletion requests. We do not sell your personal data. We are not claiming a formal certification here.
• Building towardSOC 2: not certified. We build our practices with SOC 2 principles in mind, have not completed an audit, and don't claim a report today. We'll say so plainly here if and when that changes.
• Building towardHIPAA: some of the businesses we serve are HIPAA-adjacent. We are not HIPAA-certified. We consider a signed Business Associate Agreement (BAA) case by case for regulated customers — ask us, and we'll walk through what data would flow where (what the hound will see, which sub-processors touch it) before anyone signs. Please don't send protected health information through your hound until coverage is confirmed in writing.
• On requestSecurity questions & reviews: if your procurement or security team needs to assess us, email us and we'll work through your questions directly.