How Anvil handles your data.

Section 01

Source Document Handling

This is Anvil's foundational commitment. When you upload a regulatory document for analysis, that document is never written to any disk, never retained in any database, and never stored in any retrievable form associated with your account.

Specifically, source documents are:

• Transmitted from your browser to our processing pipeline over TLS 1.3
• Held in memory only for the duration of the analysis session
• Passed to the Anthropic API for analysis under a zero data retention agreement (see Section 3)
• Discarded from memory upon completion of analysis
• Never logged, indexed, associated with your account record, or accessible after the session ends

The document hash (a cryptographic fingerprint, not the document content) is stored alongside your generated brief to enable caching — see Section 2. The hash cannot be used to reconstruct the source document.

Section 02

What Anvil Stores

Anvil stores three categories of data, all in encrypted, row-isolated storage. Each category is accessible only to the account that created it.

Account Information

Firm Profile

The firm configuration matrix that drives differentiated output. Stored because it is the primary input to Anvil's analysis — without it, every session would require re-entering the same information.

Generated Compliance Briefs

The compliance briefs Anvil generates are stored for caching purposes so that re-running an identical analysis does not require a duplicate API call. A cached brief is keyed to the document hash, firm type, prompt version, and model version — meaning a prompt update automatically invalidates all prior cache entries for that document.

Section 03

Third-Party Services

Anthropic API

Source documents are transmitted to Anthropic's API for natural language analysis. Anthropic processes these documents under a zero data retention agreement — documents are not stored on Anthropic's systems, are not used to train or improve any model, and are not accessible after the API call completes. Anthropic's privacy policy governs their handling of API traffic and is available at anthropic.com.

Supabase

User credentials, firm profiles, and generated compliance briefs are stored in a Supabase-managed PostgreSQL database hosted in the United States. Supabase provides encryption at rest (AES-256) and in transit (TLS), and Row Level Security policies enforce strict per-account data isolation at the database layer — no application-layer logic is required to keep one firm's data from being accessible to another.

Anvil does not use advertising networks, analytics services, third-party tracking, or data brokers. No data is sold or shared with any party other than those described above.

Section 04

Data Retention

You may request deletion of your account and all associated data at any time by emailing [email protected]. Deletion requests are processed within 14 days. Backup systems may retain deleted data for up to an additional 30 days before it is purged from all storage systems.

Section 05

Security Architecture

• All data in transit encrypted via TLS 1.3
• All data at rest encrypted via AES-256
• Row Level Security enforced at the PostgreSQL layer — cross-account data access is prevented at the database, not the application
• API keys stored as environment variables, never hardcoded, rotated on a defined schedule
• Access to production systems limited to the founding team
• No source documents are ever written to disk at any layer of the stack

Anvil is a pre-launch prototype. While the security architecture described above is in place, we are not yet SOC 2 certified. We are building toward SOC 2 Type II as a Phase 2 milestone and will communicate that certification to all registered users when it is obtained.

Section 06

Your Rights

You have the following rights with respect to data Anvil holds about you. To exercise any of them, email [email protected] with the subject line matching the right you are exercising.

We will respond to all rights requests within 30 days. If a request cannot be fulfilled within that period, we will notify you and provide an estimated completion date.

Section 07

Cookies and Tracking

Anvil uses session cookies only — a single cookie to maintain your authenticated session while you are logged in. This cookie is:

• Created at login and destroyed at logout or session expiry
• Scoped to the Anvil domain
• Not accessible to third-party scripts
• Not used for tracking, advertising, or analytics

Anvil does not use tracking pixels, fingerprinting, behavioral analytics, or any persistent identifier other than the session cookie described above.

Section 08

Changes to This Policy

We will notify all registered users of material changes to this Privacy Policy by email at least 14 days before they take effect. Minor clarifications that do not affect data handling practices may be made without advance notice.

The current effective date of this policy is always shown at the top of this page. Prior versions are available on request by emailing [email protected].

Section 09

Contact

Privacy questions, data rights requests, and policy concerns can be directed to: