Your contracts, private by default

Encryption in transit

All traffic uses TLS 1.2 or higher, with HSTS enforced by our hosting. Browsers refuse to load Kept over plaintext HTTP.

Encryption at rest

Uploaded PDFs live in a private object store, encrypted at rest with AES-256. Signed download URLs expire five minutes after they're issued.

Daily backups

The database that stores your contract fields is backed up daily with point-in-time recovery over a rolling 7-day window. In the event of data loss on our side, we can restore your register to any point within that window on request.

Per-user isolation

Row-level security is enforced in the database itself. A signed-in user can only read and modify their own contracts, settings and documents. There is no admin backdoor into contract content.

AI extraction

When you upload a PDF, we send its contents to a language-model provider to extract structured fields. Payloads are not used to train the model. You can delete a contract (and its stored PDF) at any time.

Auth and sessions

Sign-in uses email + password or Google OAuth. Sessions are stored as secure HTTP-only cookies. Password resets and email verification use signed one-time links.

Sub-processors

We keep the vendor list short and boring:

• Lovable Cloud — application hosting, database, and encrypted object storage.
• Lovable AI Gateway — routes contract text to OpenAI and Google language-model APIs for field extraction.
• Email provider — transactional emails for reminders, password resets and account notifications.

No third-party tracking

No analytics scripts, no ad pixels, no session recording. Outbound calls happen only when you load a page or run an AI extraction.

Data export & deletion (GDPR)

One-click CSV export from the contracts list. Delete your account from the account page and every stored PDF is removed from object storage within minutes, together with your contract records. Written requests to privacy@keptreminded.com for access, correction or deletion are answered within 30 days.