Security and data handling, revision B, October 2026
Your data.
Every step, explained.
SPT boring logs and hand-auger profiles describe someone else’s site. This page says plainly how that data is protected and where the limits are, so you can answer your client’s questions without guessing.
Where your log goes
Five hops. One honest exception.
1 · BrowserYou uploadYour PDF or photo leaves your browser over an encrypted connection.TLS 1.2 or later
2 · StorageEncrypted objectThe file waits in a short-lived upload area until the run starts. Then it is encrypted under a key unique to your account, and the upload copy is deleted.Sealed at run start
3 · WorkerPage renderedA worker decrypts one page at a time and renders it to an image in memory.Memory only
4 · ProviderThe model readsThe rendered page image goes to the AI provider as plaintext. On a single PDF, pages left out of the quote as non-logs are never rendered or sent.Plaintext · ≤ 30 days
5 · ReturnStructured resultExtracted values come back, are validated, and go into your vault.TLS · vault
Step 4 is the one honest exception, and it is unavoidable: a vision model cannot read an image it cannot see. Everything else in the chain is designed so that, apart from the short wait in the upload area before a run starts, plaintext exists only in the memory of our API and extraction worker, for the request or job that needs it.
At rest
Two keys, and you hold one.
Two different keys protect two different kinds of data, and only one of them is ours.
- Your vault key protects your projects. When you set a vault passphrase, your browser derives a key from it (Argon2id) and uses it to wrap a random 256-bit vault key. Every project is encrypted in your browser with that vault key before it is uploaded. We store the wrapped key and the ciphertext; we never see the passphrase or the unwrapped key, so we cannot open a project. Not for support, not for a subpoena. A breach of our stored data alone does not expose them.
- A recovery key stands in for a forgotten passphrase. You are shown it once at setup. With neither the passphrase nor the recovery key, your projects cannot be recovered by anyone. Changing the passphrase re-wraps the key; nothing is re-encrypted.
- A short-lived upload area comes first. An uploaded file sits there, protected by our storage provider’s own encryption at rest but not yet by your account’s key, until the run starts and seals it. An upload that never becomes a run is deleted, usually within an hour and normally within 2 days.
- A server-held per-account key protects job files in flight. Once a run starts, uploaded scans, rendered pages, extraction checkpoints and the extracted result exist on our side only while a job runs and for the retention window after it, encrypted with AES-256-GCM under a key unique to your account and wrapped by a managed key service. Unwrapped keys exist only in the memory of our API and extraction worker, for the request or job that needs them.
- Database. Holds account, job, credit and audit records (ids, sizes, timings, token counts) and encrypted project names. Not page images or extracted values. Nightly backups are encrypted with a public key whose private half is kept offline. We keep 30 daily and 12 monthly backups, so a copy of a record can normally remain in a backup for up to 12 months. Our hosting provider also keeps 7 daily images of the server disk, and we keep 4 weekly snapshots, so a copy can last about 4 weeks. These images are protected by the provider’s access controls, not by our offline backup key.
- Logs and error reports. Built to leave out file names, page content and extracted values. Our web server masks your IP address in its access log; our application server’s own access log keeps the full IP address and the request line until it is rotated out by size (about 30 MB of log, which can take weeks at low traffic), and in the server disk images for about 4 weeks after that.
- Deleting your account. When the 30-day (720-hour) grace period ends, we delete your account records, your sign-in and the key that protects your job files. Stored files are purged within 30 days after that. Your vault key was never ours. Database backups are not rewritten: until they age out, normally up to 12 months, they still hold your account, audit and billing records, readable with our offline backup key. The server disk images above hold the same records for about 4 weeks.
During the AI read
What the model sees, and for how long.
Extraction runs on Anthropic’s Claude models through their API. OpenAI may also process pages when a job uses it, and runs AI Layer Correlation when you choose it. What that means for your data:
- No training. Both providers exclude API traffic from model training under their commercial terms.
- Retention. Anthropic retains API inputs and outputs for up to 30 days for abuse monitoring under its June 2026 policy. Zero-data-retention arrangements exist for approved customers; we will apply once our volume qualifies, and we keep our default model on the tier that is eligible for it. OpenAI announced zero-data-retention for eligible API customers in August 2026.
- What is sent. Only rendered PNG images of the pages and the extraction instructions. Apart from what is printed on the page itself, we never send your project name, client name, account details or previous extractions, except as described below for re-reading a field and AI Layer Correlation.
- AI Layer Correlation is the other exception. When you run it, the decrypted boring summaries for that request (boring numbers, elevations, depths and soil-type changes) and the name you gave the cross-section go to the AI provider you choose, for that request only, so it can compare layers across borings. The project file itself is never sent and stays encrypted under your vault key, and the same retention terms above apply.
- Re-reading a field. When you ask the AI to re-read one field, we send that page image, the field’s current value, any suggested alternatives and the reason it was flagged, for that request only.
- What comes back. Structured JSON. It is validated against a schema and treated as data; nothing the model returns is executed or rendered without escaping.
- The Max+ option. Max+ runs the read on Claude Fable 5.1. Anthropic retains Fable-class inputs and outputs for 30 days regardless of zero-retention status. The app shows this notice when you select it; the default models are not affected.
Where this page will change: when zero-data-retention is in place with a provider, this section will say so with the date. Until then the 30-day window is the number to give your client.
Retention and deletion
What we keep, and when it goes.
| What | How long | Your control |
|---|---|---|
| Uploaded scans and rendered page images | 7 days after the run ends (finished, failed or cancelled), by default; you can set 0 to 30 days in Settings. Files of a paused run are kept for the same period from when it paused, and for at least 1 day. | Settings, or delete now |
| Extraction checkpoints (the resumable session) | Same as the scans they belong to | Delete the session |
| Extracted result held for your browser to collect | Until your browser confirms the project is saved to your vault, then with the job files | “Delete on completion” per account |
| Unfinished uploads that never became a job | Usually within an hour; normally within 2 days | — |
| Projects and their version history (vault-encrypted) | While your account is active; we keep the last 20 versions and one per day for the last 30 days, and prune the rest. A pruned or deleted version is destroyed about 7 days later | Restore a version, delete |
| Balance ledger, receipts, audit trail | While your account exists; deleted with the account when its deletion takes effect, then held in backups until they age out | View your balance history and receipts in the app; write to us for the audit trail |
| Inactive account (no sign-in, no credits left) | We may warn you at 12 months and may delete the account at 15 | Sign in to keep it |
| Account deletion request | When the 30-day (720-hour) grace period ends, we delete your account records, your sign-in and the key that protects your job files. Stored files are purged within 30 days after that. | Self-service in Settings; sign in or Cancel to stop it. You cannot schedule a deletion yourself while a run is in progress or paused with credits still held, while a payment dispute is open, while a refunded amount is still owed (Terms §7.6), or while your account is suspended. In those cases, write to us. We delete the account once the run ends, the amount is settled or written off, or the dispute, breach or other reason for the suspension is resolved. If only a run is in the way, we delete it no later than 90 days after your request. |
| Encrypted database backups | 30 daily and 12 monthly copies, so normally up to 12 months | — |
| Server disk images | 7 daily images kept by our hosting provider and 4 weekly snapshots we keep, so about 4 weeks | — |
Your account
Sign-in, sessions, and who can reach what.
- Sign in with email and password, Google, or Microsoft. Two-factor authentication (authenticator app) is available to everyone and required for anyone with administrative access to the service.
- You can sign out of every device at once from Settings. Password resets never expose stored data.
- Top-ups, refunds, credit adjustments, administrator actions (including an administrator viewing an account), some run events, vault changes and acceptance of the Terms are written to an audit trail. Write to us for a copy of yours.
- Your data is scoped to your account at the database level; no request can reach another account’s rows by changing an id.
Payments
Cards stay with Stripe.
Top-ups are processed by Stripe. Card numbers never touch our servers; we store only Stripe’s reference tokens and the amounts. Purchases are not refundable, except as our Terms (§7.4, §9A and §15) say. If a charge is ever reversed, the money goes back to the original payment method. Card testing and scripted sign-ups are limited by Stripe Radar, 3-D Secure on first purchase, and per-account spending limits in the first 7 days.
What we don’t do
What we don’t do.
- We do not open your job files or page images, except when you send us a page yourself. Our extraction worker decrypts them to render them.
- We do not sell your data, and we do not share or aggregate it with anyone, including other customers, beyond the service providers that run the Service (listed in our Privacy Policy), or where the law requires, or to a buyer of the business that keeps these promises.
- We do not use your corrections to improve the tool unless you opt in or send them to us in a report.
- We do not keep your source scans longer than your retention setting, except that the files of a paused run are kept for at least 1 day.
- We do not keep a copy of your vault passphrase or recovery key, and we cannot reset either.
- We do not claim end-to-end encryption to the AI model. It does not exist for this kind of work, and anyone who says otherwise is describing something else.
What’s next
Three things in progress.
- Field capture app. Photograph logs on site and upload straight to a job from a phone, through the same encryption path.
- Zero-data-retention agreements with the AI providers, dated on this page when they are in place.
- Independent assessment (SOC 2 Type I) when customers need it in writing.
Report a problem
Found something? Tell us first.
Email security@splitspoon.ai. We acknowledge within two business days, fix confirmed issues before disclosing them, and credit reporters who want it. If you believe your account has been accessed by someone else, use the same address and we will revoke sessions immediately.
Last reviewed: October 2026. This page is versioned; material changes are announced by email and in the app.