Security
Three of these are built into SPEIDER's architecture rather than written down as policy. The rest are safeguards on accounts and access that we built on top.
01
When you upload a contract or filing, we read it once to pull out a few structured facts (counterparty names, agreement types, industry, jurisdictions, suggested keywords), then the file is gone. It's never saved to our database, never written to disk, never dropped in a folder. It only exists for the few seconds it takes to read it, usually well under thirty. What we keep is the client profile those facts go into, which you can see and edit. The document itself can't leak later, because we never had it after the read.
02
Every workspace's data is fenced off using row-level security on the database itself, not application-layer checks that engineers can forget. One firm's information can't reach another firm's account, even by mistake.
03
We use Claude by Anthropic for the writing and Voyage AI for matching, both on paid plans, and neither trains on what we send them. Your client information is never used to improve any model, ours or theirs.
Also built in
Every account needs a second step at sign-in, either a passkey or an authenticator app. A firm can go further and require passkeys only, or authenticator apps only, for all its lawyers. Single-use recovery codes cover a lost phone.
Each lawyer can be signed in on 3 devices at once. A new device has to sign an old one out first, so nobody can quietly stay signed in on your account while you use it.
We look for patterns ordinary use doesn't produce, like repeated data exports or someone probing for another firm's records. Anything serious alerts us right away. If a breach puts your data at risk, we tell you without undue delay and, where feasible, within 72 hours.
We record who did what and when for data exports, deletions, team and permission changes, and two-factor changes. We keep that log for a year, because breaches are often found months after they happen.
Both are in account settings, no email to us needed. Deleting asks for your password or an emailed code first, so an open laptop isn't enough to erase an account.
We host on Vercel and Supabase. Both are SOC 2 compliant, encrypt data at rest, and run TLS in transit. Daily database backups are on by default. Payments run on Stripe's own checkout page, so card numbers never reach our servers. None of this is a SPEIDER feature; it's what any modern hosting and payment provider gives you. We mention it for completeness, not as a flex.
Every vendor that handles your data is named in Annex 3 of our Data Processing Agreement.
A specific question about how a piece of this works? Email hello@speider.ai.
Email hello@speider.ai with what you found and the steps to reproduce it. We'll reply within two business days and keep you posted until it's fixed.
In scope: speider.ai and the SPEIDER app. A problem in one of our providers (Vercel, Supabase, Stripe, Anthropic, Voyage AI) goes to that provider; they're listed in Annex 3 of our Data Processing Agreement.
We treat good-faith research within these lines as authorized, and we won't take legal action over it or ask anyone else to. We don't run a paid bounty.
Try it on one of your own clients.
14 days free, then $29 a month. A card is required to start, and you won't be charged if you cancel before day 15.