Skip to main content
GistCiteGistCite

Security & Compliance

What GistCite actually does to protect your data, and how that maps to the frameworks people ask about. Where a framework requires a formal audit we say so plainly — this page describes real controls, not badges.

GDPR

Rights built in

Access, portability, and erasure are self-service: export every piece of personal data as JSON or delete the account and all its records from the Account page — no support ticket needed. Processing is minimal by design: files are handled in memory and never stored.

CCPA / CPRA

Rights built in

The same tools cover California's right to know and right to delete. GistCite does not sell or share personal information, and there is no advertising or cross-context tracking of any kind.

SSL / TLS

Encryption in transit

Production deployments terminate TLS in front of the app; HSTS is pre-configured and enabled with the certificate. Passwords are bcrypt-hashed, sign-in codes and API keys are stored only as digests — no plaintext secret ever touches the database.

AICPA SOC 2

Controls aligned — not audited

The Trust Services Criteria guide the technical controls: least-privilege auth (JWT for the account, scoped API keys for automation), structured audit logging, rate limiting, quota metering, and stateless in-memory file processing. A formal SOC 2 audit has not been performed, and we won't claim otherwise.

ISO/IEC 27001

Controls aligned — not certified

Annex A themes are reflected in the codebase: access control, cryptography for credentials, logging and monitoring hooks (structured logs + Prometheus metrics), and documented data retention. Certification requires an organizational ISMS audit we have not undergone.

HIPAA

Not for PHI

GistCite is not a HIPAA-covered service and does not sign Business Associate Agreements. Do not upload protected health information. The in-memory, nothing-stored processing model limits exposure, but that is not a substitute for a BAA.

Technical controls

  • Files (PDF, Office, audio) are processed in memory and never written to disk or object storage.
  • Passwords hashed with bcrypt; OTP sign-in codes and API keys stored as HMAC/SHA-256 digests only.
  • JWT-only authentication for sensitive account actions — API keys cannot export or delete the account that owns them.
  • Per-IP rate limiting on every extraction and tool endpoint.
  • Structured audit logs (structlog) for auth, billing, and data-rights events; Prometheus metrics for monitoring.
  • Security headers on every response: nosniff, frame denial, strict referrer policy, and a minimal permissions policy.
  • Payments handled entirely by Stripe — card numbers never reach GistCite servers.
  • Data minimization: extraction caches are keyed by content, not by person; account deletion removes every user-linked row.

Exercise your rights

Export or delete your data any time from your account — or read the full policies.

Privacy & data toolsPrivacy PolicyTerms of Service