Security
Your compliance documents are the evidence your business runs on. This page states, without marketing language, where they live, how they are protected, and how you get them out. Lettuce Labs LLC, a Delaware limited liability company, is the data controller.
At a glance
- Data location
- United States. Database, file storage, and hosting all run in US regions.
- At rest
- Encrypted at rest by the managed Postgres provider's default encryption.
- In transit
- TLS on every connection, browser to application and application to every subprocessor.
- File storage
- Private-only. Uploaded documents are never publicly addressable; every download passes an authenticated, authorised server-side check.
- Backups
- The database provider's point-in-time recovery.
- Audit log
- Append-only. Actions on documents and requirements are recorded and cannot be edited or deleted afterwards.
Retention
- Documents you upload to your account are kept for as long as the account is active.
- Free gap-check uploads are deleted as soon as processing finishes. The file itself is not retained.
- Free gap-check reports are deleted after 30 days.
Export and deletion
You can export everything (documents, extracted values, and the audit history) as a zip at any time, from inside the product. On request, your account and its data are deleted within 30 days; write to support@compliantalways.com. Export first if you need the records, because deletion is final.
Subprocessors
These are the only third parties that process customer data, and what each one does.
| Provider | Role | What it processes |
|---|---|---|
| Neon | Database | Managed Postgres holding account data, extracted document values, and the audit history. |
| Vercel | Hosting and file storage | Runs the application and stores uploaded documents in private blob storage. |
| Clerk | Authentication | Sign-in, sessions, and account identity. |
| Stripe | Payments | Subscription billing. Card details go to Stripe directly and never touch our servers. |
| Resend | Transactional email: expiry warnings, receipts, and manufacturer document requests. | |
| OpenRouter (default) or Anthropic | Document reading and the in-product assistant | Reads uploaded documents and answers questions about your account. The provider is an operator-configured setting; customer content is not used to train any model, under either provider. |
Reporting a concern
If you believe you have found a vulnerability, or have a question this page does not answer, write to support@compliantalways.com. It reaches the person who built the system, not a queue.