Privacy

What we keep, where, and for how long.

Last updated 2026-10-01

Three data classes

Every piece of evidence you add carries one class. The class decides who may read it.

Public — web pages, filings, press. May go to any connected model provider.
Target-confidential — what the company shared with you: decks, exports, contracts. Only sent to providers with zero data retention.
Fund-internal — your own notes and views. Only sent to providers with zero data retention.

What is stored where

Account, workspace, targets, the evidence ledger and memos: Neon Postgres.
Uploaded files and rendered exports: Vercel Blob, behind links that expire within 15 minutes.
Web functions: Vercel, in Frankfurt and Washington DC.
Agent sandboxes: Vercel Sandbox, US region only for now. An EU-only mode is planned; until it ships, do not upload data that must stay in the EU.
Email (sign-in codes, invitations): Resend.
Errors and traces: Sentry and Axiom. They carry ids, never evidence text, prompts or keys.

Model providers

Model calls go through the Vercel AI Gateway to the providers you connect with your own keys (Anthropic, OpenAI, Mistral). Their retention policies apply to what they receive; the data class rules above decide what they receive. We do not train models on your evidence and we do not sell data.

Retention

Your workspace data: kept until you delete it. Export everything at any time.
Deleted workspaces: removed from the database and file storage within 30 days.
Traces: 30 days. Aggregated metrics: 90 days.
Sign-in codes: expire after 10 minutes.

Cookies

The product sets one session cookie. This public site uses cookieless Vercel Web Analytics to count page views; you can opt out from the notice at the bottom of the page. There are no advertising or cross-site cookies.

Your rights

For access, correction, deletion or a copy of your data, email hello@thediligence.app. We answer within 30 days. A data processing agreement is available on request.