What happens to your data, stated exactly.

At a glance

• ✓Everything is encrypted in transit and at rest, with row-level security scoping every request to the account that made it.
• ✓Uploaded documents live in private, per-account storage. No other customer can reach them, and they never join the shared search index or the public demonstration corpus.
• ✓We never train any AI model on your content. Every language-model call goes only to the listed providers based in the United States or the European Union, with the instruction not to store the content or train on it. If no such provider is available, the request stops.
• ✓You can delete any document, with its extracted text, at any time. Closing your account removes your documents with it.
• ✓A short, named list of service providers processes data on our behalf. It is published below and kept current in the Privacy Policy.
• ✓Storage and compute regions, and anything else specific to your jurisdiction, are stated in the security schedule provided with your agreement.

To answer a Desk question, your question, the source material retrieved for it, and any documents you attached are sent through OpenRouter to language-model providers, to draft the answer and to check each citation in it against its source. For these calls we instruct OpenRouter to use only providers that do not store the content or train on it, and only the providers listed below. This is enforced, not aspirational: if no listed provider is available for the model, the call fails rather than go anywhere else.

Scanned or photographed uploads are first read by optical character recognition (Mistral AI) in the European Union (Paris) to extract their text. On our paid plan that content is not used to train any model and is deleted within 30 days. We run no model training of our own, on anything.

One honest limit, named before you ask: model inference runs on the infrastructure of the named AI providers. A deployment can anchor your database and documents to a jurisdiction; it cannot put the language model there. The providers for each job, and where they state it the country where they process, are listed below with the date of the last change.

Storage and compute regions are stated in the security schedule that accompanies each agreement, alongside the current subprocessor list and backup posture. The countries where model providers process data are listed on this page, because our Privacy Policy points to them. Data-centre and region details for your own deployment stay in the signed schedule: a schedule you can hold us to is worth more than a webpage claim, and it is re-verified against the running systems before signature.

For organisations that require in-country handling, a dedicated deployment in a nominated jurisdiction is available as a configuration of the same product. The model-inference limit above applies there too, and we will name it in the schedule.

On request: a Data Processing Addendum; a security schedule stating regions, subprocessors, and backup posture for your agreement; written confirmation of the current data-handling and retention settings of each provider used; and a summary of how your data is handled, for your compliance file. Write to support@pfmexpert.net and name the documents your procurement needs.