Skip to main content
GistCiteGistCite

Security & Compliance

What GistCite actually does to protect your data, and what it has not done. This page describes real controls, not badges.

Not independently audited

GistCite has no SOC 2 report, no ISO 27001 certificate and no third-party penetration test. It is built and run by a small team, and everything below is our own description of our work. Read the next section before you put client material through it.

What it is suitable for today

A good fit

  • Public material: videos, podcasts, published reports, web pages.
  • Your own recordings, notes and drafts.
  • Client documents your client has agreed may be processed by a third-party tool that has not been audited.

Not a fit yet

  • Work under a contract that requires SOC 2, ISO 27001 or a penetration-test report from every vendor.
  • Protected health information, or anything that needs a signed BAA.
  • Material your client has not agreed to share with outside processors. AI features send the text to the model provider (Anthropic, or your own key's provider).
  • Teams that need single sign-on, per-user roles or an audit trail of who opened what.

Regulations and frameworks

GDPR

Rights built in

Access, portability, and erasure are self-service: export every piece of personal data as JSON or delete the account and all its records from the Account page — no support ticket needed. Processing is minimal by design: uploaded files are processed and discarded, never kept; the extracted text is kept until you delete it.

CCPA / CPRA

Rights built in

The same tools cover California's right to know and right to delete. GistCite does not sell or share personal information, and there is no advertising or cross-context tracking of any kind.

SSL / TLS

Encryption in transit

Production deployments terminate TLS in front of the app; HSTS is pre-configured and enabled with the certificate. Passwords are bcrypt-hashed, sign-in codes and API keys are stored only as digests — no plaintext secret ever touches the database.

AICPA SOC 2

Not audited

GistCite has not had a SOC 2 audit and holds no SOC 2 report. If your client or your procurement team requires one, GistCite does not meet that requirement today. The controls listed below are what exists; nobody outside the team has examined them.

ISO/IEC 27001

Not certified

GistCite is not ISO 27001 certified and does not run an audited information security management system. There has been no independent penetration test either. Treat the controls below as the team's own description of its work.

HIPAA

Not for PHI

GistCite is not a HIPAA-covered service and does not sign Business Associate Agreements. Do not upload protected health information. Uploaded files are discarded after processing, which limits exposure, but that is not a substitute for a BAA.

Technical controls

  • Uploaded files (PDF, Office, audio, video) are processed and discarded, never kept. The extracted text is stored so you can come back to it, until you delete it or your account.
  • A document or recording you upload can be opened only by you: reading it needs your sign-in (or, without an account, the browser that uploaded it). Its link alone opens nothing, for a visitor or for another account.
  • Passwords hashed with bcrypt; OTP sign-in codes and API keys stored as HMAC/SHA-256 digests only.
  • JWT-only authentication for sensitive account actions — API keys cannot export or delete the account that owns them.
  • Rate limiting on every extraction and tool endpoint: per API key for requests made with a key (30 a minute by default), per IP address otherwise.
  • Integrations (the SDKs, the MCP server, the n8n node, the Chrome extension and the Zapier app) authenticate with API keys you create and revoke on the Account page. Signing in to connectors with OAuth is being built and is not available yet.
  • Structured audit logs (structlog) for auth, billing, and data-rights events; Prometheus metrics for monitoring.
  • Security headers on every response: nosniff, frame denial, strict referrer policy, and a minimal permissions policy.
  • Payments handled entirely by Stripe — card numbers never reach GistCite servers.
  • Data minimization: extracted text is stored once per file, keyed by a fingerprint of its content rather than by person, so a second upload of the same file is served from that copy, and only to someone who uploaded it. Account deletion removes every row linked to you.

Exercise your rights

Export or delete your data any time from your account — or read the full policies.

Privacy & data toolsPrivacy PolicyTerms of Service