Security and data protection

Where your data is stored, and you choose the region

Each organisation picks its region when the account is created, and everything that organisation creates stays in that region. Your current region is shown in Settings.

• Canada — Central Canada (Montréal)
• European Union — Frankfurt, Germany
• United States — Northern Virginia

Vendor specifications are not retained

Supplier PDFs are read in your browser. The extracted text is sent for the single generation or comparison you asked for, held only for that request, and discarded when it finishes. We never write the specification to storage or to the database. What is kept is what you reviewed and approved: the requirements themselves, and a short reference snippet of at most 200 characters per requirement so a reviewer can trace where a requirement came from. Vendor comparison follows the same rule — the stored result holds the judgement and short evidence snippets, never the source document. A document uploaded to the free gap analysis is read once to produce the result and then discarded; neither the file nor its extracted text is written to storage or to the database, and only the analysis result is kept.

AI processing

Drafting and comparison use commercial AI provider APIs. Under those commercial API terms, content you submit is not used to train the providers' models. Text is sent for the duration of the request only, and no vendor document is ever included as a stored file.

Encryption

All traffic is served over TLS 1.2 or higher. The database, file storage and backups are encrypted at rest by the hosting provider using AES-256.

Access controls

Every table carries row-level security enforced in the database, not only in the interface. Projects, requirements, templates, standards and audit records are scoped to the organisation that owns them, and requirement rows are additionally scoped to the owning project. Another signed-in account cannot read your documents even by requesting them directly. Sign-in is by email and password or Google; passwords are never stored by this application.

Sub-processors

We use a small, named set of providers:

• Supabase — managed database, authentication and file storage, in your chosen region
• Cloudflare — application hosting, TLS termination and content delivery
• Anthropic and Google — AI models used for drafting and comparison, under commercial API terms with no training on submitted content
• Resend — transactional email, such as sign-in and assignment notifications

Retention

Projects, requirements and templates are kept until you delete them or delete your account. Issued revisions and audit trail entries are append-only for as long as the account exists, because a Part 11 and Annex 11 style record cannot be edited. Vendor specification text has no retention period because it is never written down. Deleted accounts leave only the minimum billing record required by law: organisation name, region, plan, seat count and invoices already issued.

Export and deletion, in the session

In Settings you can export everything you hold as a single ZIP — every project as a Word document and as JSON, the audit trail as a spreadsheet, and a manifest — and you can delete your account and all its data after a two-step confirmation in which you type your email. Neither requires a support ticket.

What we do not claim

This platform is not a validated system and is not supplied with validation documentation. It does not carry Part 11 electronic signature functionality, and nothing here assesses or certifies your organisation's compliance. Treat exported documents as drafts entering your own controlled quality system.

Security contact

Security questions, vulnerability reports and data protection requests: security@pharma4i.com. We acknowledge within two business days.