What We Hold, For How Long, and What Is Not Finished.

No. Extraction runs against an external model API under a paid-tier agreement that prohibits training use; the deterministic engine does the analysis. Raw documents are held no longer than 30 days under a documented retention ceiling. What persists beyond that is derived — the verdict, the judgment analysis, and structural data in the Judgment Graph benchmark corpus. That structural record can include identifying details such as founder names, so it remains subject to your erasure rights; systematic de-identification is on the roadmap, not shipped. No customer document enters any training corpus.

Today, one region: askOdin is operated from Singapore under PDPA, and document extraction calls an external model API (the Google Gemini Developer API, paid tier). A configurable processing region is on the roadmap and is not shipped. If residency in a particular jurisdiction is a gating requirement for your firm, tell us before you upload anything and we will tell you where that work stands.

Cloudflare for edge security and object storage, and the Google Gemini Developer API for document extraction, behind a swappable adapter layer. Extraction is the model's only role — it maps unstructured documents into typed variables, and the deterministic engine does the analysis. The sub-processors are named publicly in section 5 of our Privacy Policy; the security documentation behind them is provided under NDA.

Raw documents are held no longer than 30 days. That ceiling is a documented policy; automated enforcement of it is In Progress and ships with SOC 2 Type I, and until then deletion is executed on request. What persists past the window is derived — the verdict, the judgment analysis and structural data — never the documents. That record can include identifying details, so your erasure rights reach it.

No. There is no data-room connector or integration. Files are uploaded for each audit, so what askOdin reads is exactly what you chose to send it, and the 30-day retention ceiling applies to every upload.

Not yet. Implemented controls: AES-256 at rest, TLS 1.3 in transit, stateless API orchestration, a documented 30-day retention ceiling on raw documents, and PDPA compliance. In progress: SOC 2 Type I, a GDPR Data Processing Agreement, and automated enforcement of the retention policy. On the roadmap: SOC 2 Type II and ISO 27001. We distinguish a stated policy from an implemented control and will tell you which is which — documentation is available under NDA for your security review.

A Data Processing Agreement with Standard Contractual Clauses for cross-border transfers is in preparation and is not yet available for signature. Contact the security team and we will tell you where it stands rather than quote a date we cannot evidence.

On the evidence, tier by tier. Every control on this page is labeled as stated policy, implemented or in progress, so your reviewer can test each claim at the level it is made. The sub-processors are named publicly in section 5 of our Privacy Policy; the security documentation behind this page is provided under NDA. Send your questionnaire or checklist with the request and we will answer it against the same tiers. SOC 2 Type I is in progress, not held, and the Data Processing Agreement is in preparation. If a certificate or a signed DPA is a gating requirement, raise it at the start and we will tell you where it stands. Request security documentation.

Stateless, yes; dedicated, not yet. The runtime uses stateless API orchestration, and raw documents are held no longer than 30 days under a documented retention ceiling; the derived judgment record persists so the audit trail survives the document. Single-tenant deployment is on the roadmap and is not shipped. Tenant isolation on the shared processing cache is being hardened and is not yet complete — if strict isolation is a gating requirement for your firm, talk to us before you upload anything, and we will tell you exactly where that work stands.

Auditable and traceable, yes. Every verdict produces a Defensible Audit Log: each finding traced to the page or cell it came from, the Framework version that produced the score, and the SHA-256 fingerprint of the files read — a record you can put in front of an IC, an LP or an examiner. Whether that record satisfies a given regulator is the fund's determination, not ours; askOdin is not a regulated entity and does not certify compliance.