Security and Data
Last updated October 24, 2026.
For firms and teams checking where client information goes. Ask for our data agreement through the contact form.
Where data is kept
ReportDraft runs in the United States. The database, your files, photos and signed documents, and our nightly backups are all kept there.
Who processes it
| Provider | What it does for us | Where |
|---|---|---|
| Railway | Hosting: runs the service and stores the database, your files and backups | United States |
| Stripe | Payments and billing. Your card details go to Stripe, never to us | United States, and other countries where Stripe operates |
| Resend | Sends our emails (sign-in codes, receipts, reminders) | United States |
| Our document drafting provider | Turns the notes you submit into a draft document. Named in the data agreement we offer firms | United States |
| Cloudflare | Domain names and network delivery of our pages | Worldwide network |
Our document drafting provider uses the content we send it only to provide its service and to monitor for abuse, and keeps it for no more than 30 days unless the law requires longer. It does not use it to improve its own products.
How it is protected
- Every connection to ReportDraft is encrypted (HTTPS).
- No passwords: you sign in with a one-time code sent to your email, and sign-in attempts are rate limited.
- Each account's reports are kept separate; team members see only their own team's reports, and only owners and admins can change billing or invite people.
- Signed documents are locked and fingerprinted, so any later change is visible, and every signature is logged.
- The database is backed up every night and backups are kept for 14 days.
- Card details go to our payment processor and never reach our servers.
Your data, your control
You can download every report as PDF and Word at any time. When you ask us to close your account, we delete your data, apart from billing records we must keep by law.
Reporting a security problem
If you find a security issue, tell us through the contact form. We look at every report.