Your Documents Are Yours

1. 01

   Upload

   TLS 1.3 in transit. Documents uploaded directly to encrypted object storage.

2. 02

   Processing

   AI extraction parses your document into structured chunks. Processing is ephemeral — model providers do not retain content.

3. 03

   Knowledge Model

   Stakeholders, objectives, systems, constraints, and requirements are stored as entities scoped to your project.

4. 04

   Analysis

   Gap detection, traceability, and maturity scoring run against your Knowledge Model — no cross-customer data is used.

5. 05

   Storage

   All project data encrypted at rest with AES-256. Isolated per account.

6. 06

   Deletion

   You can delete any project or your entire account at any time. Deletion is propagated to storage and database within 24 hours.

RequirementsHub uses two AI providers to extract entities and generate analysis: Anthropic (Claude) and OpenAI (GPT). Both are accessed under enterprise API terms that prohibit using customer data for model training.

No other AI providers are used. Document text is sent to these providers only to fulfill your analysis request, and is not retained by them beyond the inference window.

Customer documents and project data are isolated by account. RequirementsHub staff do not access customer data except to resolve a support request at your explicit written consent.

Production access is restricted to a small engineering team, scoped via least-privilege roles, and audited.

• Export all your data at any time (JSON + original documents).
• Delete individual projects from your account dashboard.
• Delete your entire account — including all documents, entities, and generated outputs — on request. GDPR-equivalent erasure.

Questions: security@requirementshub.ai

Access to production systems and customer data is restricted to a small number of named engineering and operations staff with a documented business need. Access is granted on a least-privilege basis and reviewed periodically. Access is revoked promptly on role change or departure.

Multi-factor authentication is enforced on all staff accounts used to administer production systems, including the database, hosting platform, source control, and subprocessor consoles. Staff devices used to access production are required to use full-disk encryption and screen-lock.

Third-party access — for example, contracted security testers or auditors — is granted only under written agreement, scoped to the work in question, time-bound, and removed on completion. Vendor access is never standing.

Code review. All changes to production code are reviewed before deployment. Security-sensitive changes — authentication, authorization, data access policies, payment, AI prompts — receive additional review.

Dependency management. Production dependencies are pinned. We monitor advisories for our dependencies and upgrade promptly when security patches are released. Unmaintained or end-of-life dependencies are replaced.

Change management. Deployments are automated through our hosting platform. Each deployment is traceable to a specific code change and the engineer responsible. Rollback is available.

Vulnerability management. We use automated scanning of our dependency tree and infrastructure configuration. Findings are triaged on severity. Critical vulnerabilities affecting production are remediated as a priority.

Secrets management. Credentials, API keys, and signing keys are stored in our hosting platform's encrypted secrets store. They are not committed to source control. Secrets are rotated on staff departure and on suspicion of compromise.

We welcome reports from security researchers and customers. The reporting channel, response timelines, and recognition policy are detailed on the Incident Response page.

Researchers acting in good faith and following our responsible-disclosure guidance will not face legal action from RequirementsHub for the act of reporting.

Authentication. RequirementsHub uses passwordless authentication via email magic link. Magic links are short-lived and single-use. Password-based authentication and multi-factor authentication (MFA) are on the development roadmap.

Workspace access control. Workspace membership is controlled by workspace owners, with a role-based model:

Tenant isolation. Data is segregated per workspace and per account using PostgreSQL row-level security policies enforced at the database layer. The application code path that selects a row and the database policy that authorizes the read are independent layers — both must agree before a row is returned.

Session management. Sessions are bound to the authenticated user and expire automatically. Users can sign out from any device.

Workspace invitations. Invitations are emailed to a specific address, expire after 30 days, and can be revoked by the workspace owner at any time before acceptance.

Audit trail. Workspace owners can review an activity timeline of changes made to project content, including who made the change and when.

Data export. Any user can export their account data at any time from the Data Control Center.

Infrastructure resilience. RequirementsHub runs on Cloudflare's globally distributed runtime and Supabase's managed PostgreSQL on AWS. Both providers operate multi-availability-zone infrastructure with automated failover.

Backups. The production database is backed up continuously by Supabase, with point-in-time recovery available within the retention window. Backups are encrypted at rest. Storage objects are protected by AWS S3 durability guarantees.

Recovery targets. We are in the process of formalizing and testing the targets below.

Incident response. See Incident Response for severity classification, notification SLAs, and the customer-facing response process.

Status page. Current platform status will be published at status.requirementshub.ai (in development).

Subprocessor continuity. Cloudflare, Supabase, Stripe, and our AI providers each operate independent BCP/DR programs. A subprocessor incident is handled through that provider's processes; we notify affected customers as described in Incident Response.

Lean engineering team. RequirementsHub is operated by a small, focused engineering team. We document our recovery procedures so that any qualified on-call engineer can execute them. We do not depend on a single person to recover the service.

Our public status page is at status.requirementshub.ai (in development). Incidents are posted as soon as they are confirmed.

Planned maintenance. We schedule maintenance during low-usage windows where possible and post notice on the status page. Brief maintenance that does not interrupt customer-visible operations is not counted against the uptime target.

AI processing availability. AI-assisted analysis depends on third-party model providers. We operate primary (Anthropic), secondary (OpenAI), and tertiary (Google Gemini via Lovable AI Gateway) paths so that a single provider outage does not block analysis. Provider-side outages affecting all three paths are reported on the status page and counted toward the uptime calculation only where they prevent core platform use.