SECURITY · DATA HANDLING · SUBPROCESSORS
Trust and data handling
Where this runs, who touches your data, how long anything is kept, and what we do not have. Written so a security questionnaire can be answered from it.
Read this first
accessibility.chat is in public beta and holds no security certifications. If your procurement process requires SOC 2, ISO 27001 or FedRAMP, we do not meet it today and we would rather you learn that here than three weeks into a review. The list below is complete as far as we know it; if something is missing, that is an error to report, not a distinction to draw.
What we collect and how long we keep it
| Questions you ask Luke | Sent to the retrieval engine and to the model provider to generate an answer. Signed-in conversations are stored against your account until you delete them. |
|---|---|
| Anonymous sessions | Visitors who are not signed in get an isolated workspace retained for 30 days, then deleted. Anonymous workspaces use ephemeral storage that does not survive a redeploy. |
| Documents you upload | Parsed for the answer and stored with the project you uploaded them to. Corpus passages marked private are never returned with their text to another user. |
| Account information | Email address and authentication token, via Google sign-in. We do not store passwords. |
| Analytics | Aggregate page views through Google Analytics. No cross-site advertising identifiers and no sale of personal information. |
| Voice input | Speech recognition runs in your browser. Where the browser sends audio to its own vendor to transcribe, that is the browser’s behaviour and not ours; we receive text. |
Subprocessors
| Subprocessor | Purpose | Data received | Region |
|---|---|---|---|
| Vercel | Website hosting and edge delivery | HTTP request metadata, IP address | United States |
| Render | Luke retrieval and answer engine | Question text, uploaded documents, conversation history | United States |
| Neon (PostgreSQL) | Article, research and account storage | Account email, saved conversations, project records | United States |
| Google Firebase | Authentication | Email address, authentication tokens | United States |
| OpenAI | Answer generation and document parsing | Question text and the retrieved passages sent as context | United States |
| Anthropic | Fallback generation and offline evaluation | Question text and retrieved passages, when the primary provider is unavailable | United States |
| Google Analytics | Aggregate site usage | Page views, referrer, coarse geography | United States |
| Pexels | Stock imagery for articles | None. Images are fetched at publish time. | United States |
Certifications and assurances
- SOC 2 Type IINot held
Not held. No audit has been commissioned. Our infrastructure providers hold their own; ours would be a separate report and we do not have one.
- ISO/IEC 27001Not held
Not held.
- FedRAMPNot held
Not held and not in progress. Federal agency use would need this and we cannot support it today.
- HIPAA Business Associate AgreementNot held
Not offered. Do not send protected health information. Accessibility questions about healthcare providers are fine; patient data is not.
- Penetration testNot held
No third-party penetration test has been performed.
- VPAT 2.5 / Accessibility Conformance ReportPublished
Published, with the evidence behind every claim and the criteria nothing has measured.
Controls that are in place
- Transport encryption (HTTPS) on every route, enforced by the hosting platform.
- Secrets are supplied as environment variables and are not committed to source control.
- Cross-origin requests are restricted to an explicit allowlist rather than a wildcard.
- Outbound web audits refuse private and reserved network addresses, so the scanner cannot be pointed at internal infrastructure.
- Project-scoped retrieval fails closed: a request bound to one project cannot surface another project’s documents.
- Passages marked private never leave the engine with their text attached.
- Per-request cost ceilings and in-flight concurrency limits bound runaway usage.
- Authentication is federated to Google; we never see or store a password.
Security contact
Report a vulnerability to security@accessibility.chat. We will acknowledge within two business days. Please do not run automated scanning against production; ask and we will arrange a window.
See also the Accessibility Conformance Report, privacy policy, and terms.