How we handle your documents.

There are no passwords to steal. You sign in with your company’s SSO (SAML or OIDC) or a single-use magic link that expires in fifteen minutes. Multi-factor authentication is supported, and signing a memo requires a fresh step-up — your signature attests to the memo, so we confirm it’s you before it is recorded.

Sessions are short and revocable. “Sign out everywhere” invalidates every active session at once.

Every customer’s data lives behind Postgres row-level security. Isolation is enforced in the database, not just the application: a query carrying one tenant’s identity cannot read another tenant’s rows even if application code is wrong. An automated test suite proves zero cross-tenant reads on every tenant-scoped table before each release.

We do not train or fine-tune any model on your documents, your memos, or your edits. Analysis runs against enterprise large-language-model providers under terms that prohibit training on the content we send, and we use zero-retention processing where the provider offers it. Our subprocessors are listed in Exhibit 08, and the list changes only with notice.

Newcomb is built so that a signed memo is immutable. When counsel signs a memo, that version is frozen: each signed version is hash-chained to the one before it, so later tampering is detectable, and signed versions are protected from modification. Liveness never edits a signed memo — a changed source produces a new proposed version, and the superseded version stays on the record exactly as it was signed.

Every conclusion Newcomb draws is tied to a quoted, anchored clause; by design, a conclusion that can’t be traced to its source isn’t shown. Anything the analysis can’t classify with confidence is routed to counsel for review rather than passed silently. The system drafts; a person decides.

Sign-ins, intakes, source changes, and administrative actions — and, as signing and step-up land, those events too — are written to an append-only audit log: who did what, to which memo, and when. Administrators can export the log as CSV for their own records.

All traffic is encrypted in transit with TLS. Data at rest — documents, parsed text, embeddings, and the database — is encrypted using our infrastructure provider’s managed encryption.

Newcomb runs on managed cloud infrastructure in the United States. Analysis uses enterprise large-language-model providers under no-training terms, with zero-retention processing where the provider offers it. The current subprocessor list — infrastructure, model providers, and email delivery — is provided to design partners with the pilot agreement and updated with notice.

On request, we delete your data: the original documents, their parsed text, embeddings, every derived artifact, and exports. Deletion is destructive and is confirmed by naming exactly what is erased. Backups expire on a documented schedule, after which deleted content is unrecoverable.

During the pilot, all of this is governed by a written agreement signed before any production data is uploaded.