Trust and security
Draaftly is built for work that gets challenged, so this page is written the same way: what we promise, what the platform is built with, what is not finished yet, and who else touches your data.
Where things stand. The Draaftly platform is in early access and its controls are being built as we go; this page says what it is built with and what arrives at launch, not what an auditor has signed off. Hisaab is live, and is described separately below.
Our promises
These apply today, to everything we run.
Your data is yours
We process what you put into Draaftly only to provide the service to you. We do not sell it, and we do not use it for our own purposes.
No AI training on your data
Draaftly never uses your data to train AI models. Our AI providers, Anthropic and Google Cloud, do not use customer data from their commercial services to train their models by default.
Customers are kept apart
Draaftly is built so that one customer’s projects, documents and evidence are separated from every other customer’s — including in the AI search that retrieves material while a study is being written.
No cross-customer use
Your work is never used in benchmarks, templates, examples or another customer’s research. If we want to show something publicly, we build a fictional sample instead — every sample on this site is one.
No staff access without your permission
Our people do not open your projects to look around. Where you ask for help that needs it, access is granted for a limited time, recorded, and ends automatically.
Deletion on request
Ask us to delete your data and we will, including from backups as they age out. You can export your projects, evidence and deliverables at any time before you go.
We tell you about a breach
If customer data is affected by a security incident we will tell you without undue delay, with what we know and what we are doing — within the timelines the GDPR and India’s DPDP Act require of us.
How AI is used
The same rules in policy form are on the AI disclosure page.
What the AI does
Drafting and analysis are done by Claude models from Anthropic, accessed through Google Cloud. The AI reads your documents and public sources, and writes the narrative around them.
What the AI does not do
It does not do the arithmetic. Market sizing, cash flows, NPV, IRR, payback, DSCR and sensitivities are calculated by our own engine from logged inputs, so a number can be traced and re-run.
Your documents are data, not instructions
Anything you upload is treated as material to be analysed, never as instructions to the system. A document that contains text telling the AI what to do does not get to change how Draaftly behaves.
A person approves every deliverable
Projects move through Draft, Review, Approved and Published. Nothing is exported as final until someone on your side approves it.
Security controls Early access
What the platform is built with and what is in place at launch. We will say so here when an outside party has tested any of it.
- In transit
- TLS 1.2 or better for everything between you, Draaftly and our providers.
- At rest
- Documents, databases and backups are encrypted where they are stored.
- Separation between customers
- Per-organisation isolation in the database, in file storage and in the AI retrieval layer, so a search can only reach your own material.
- Multi-factor authentication
- MFA on accounts, and on the administrative access our own team uses.
- Roles
- Owner, Admin, Researcher, Reviewer and Client-viewer, so people see what their job needs and no more.
- Audit logs
- Uploads, downloads, exports, permission changes and any staff access are recorded with who, what and when.
- Secrets
- Keys and credentials live in a managed vault, not in code or configuration files.
- Logs stay clean
- Document contents are never written to application logs.
- Uploads are scanned
- Files are checked for malware on the way in.
- Download links expire
- Exports are served through signed links that stop working after a short time.
- Backups
- Encrypted backups with point-in-time recovery, and restores that we test.
Enterprise options Coming soon
None of these are available yet. If one of them decides whether you can use Draaftly,tell us — it moves up the list.
SSO and SCIM
Single sign-on with your identity provider, and automatic joiner and leaver handling.
Regional hosting
Hosting in a particular region, planned for enterprise customers and subject to what our providers offer there.
Customer-managed keys
Encryption keys you hold and can revoke.
Short-retention mode
Shorter retention windows for organisations that want less kept.
Audit log export
Your audit logs streamed or exported into your own tooling.
IP allow-listing
Access restricted to your own networks.
Dedicated environment
A separate environment for organisations that require one.
Hisaab Available now
Hisaab is our point-of-sale product for food businesses. It is live, sold in India, and runs on its own infrastructure. What Hisaab does
- Where data is stored
- India, in the Mumbai region.
- Who can see what
- Role-based access for owner, cashier and waiter, so staff see what their job needs.
- Getting your data out
- Export at any time. There is no lock-in, and the data belongs to the outlet.
Sub-processors
The companies that process customer data on our behalf. We tell customers before a new sub-processor starts handling their data, so there is time to raise an objection with us.
Last updated 24 October 2026.
| Company | What they do for us | Used by | Where |
|---|---|---|---|
| Google Cloud | Hosting, database, file storage, and access to the AI models | Draaftly platform | United States and other Google Cloud regions |
| Anthropic | Claude models, used through Google Cloud, for drafting and analysis | Draaftly platform | Accessed through Google Cloud |
| Supabase | Database and storage for Hisaab | Hisaab | India (Mumbai region) |
| Cloudflare | Website hosting, DNS, protection against attacks, the Turnstile spam check on our forms, and the database that stores what you send us through them | Website | Global edge network; the forms database is in the Asia-Pacific region |
| Stripe | Card payments and subscription billing | All products | United States and Ireland |
| Razorpay | Payments in India, including UPI | All products | India |
| Cal.com | Booking demo calls from our website | Website | European Union and United States |
| ResendNot in use yet | Emailing us the messages you send through our forms | Website | United States and European Union |
| Google AnalyticsNot in use yet | Counting visits to our website, with your consent only | Website | United States and other Google regions |
Rows marked “Not in use yet” are choices we have not made. Nothing is connected to customer data before it is named here.
Certifications
We have not completed a security certification yet.
Our plan, in this order:
- 1An independent penetration test before our first enterprise customer.
- 2SOC 2 Type I.
- 3SOC 2 Type II.
- 4ISO/IEC 27001.
We are not putting dates against these, because a date we miss is worth less than nothing. This page is updated when a step is actually done.
Report a security issue
If you have found something, please tell us before you tell anyone else, and we will work with you on it.
Write to hello@draaftly.comwith “Security” in the subject line.
- Tell us what you found, where, and how to reproduce it.
- Please do not access, change or keep data that is not yours while testing.
- We will acknowledge your report, keep you updated while we fix it, and credit you if you would like that.
Our machine-readable contact details are at /.well-known/security.txt.
Documents
Our policies are published as drafts while they are with our lawyers, and each one says so at the top.
- Privacy noticeWhat we collect, why, how long we keep it and what you can ask us to do.
- Terms of serviceThe agreement between you and Resolva Insights Private Limited for using Draaftly.
- Cookie noticeWhat we store on your device, and what you have to agree to first.
- Data processing agreementOur terms as a processor of the personal data you put into Draaftly.
- Acceptable use policyWhat Draaftly may not be used for.
- AI disclosureHow AI is used in Draaftly, in policy form.
- Refunds and cancellationCancelling, refunds, and what happens to your data afterwards.
A security overview and a signed data processing agreement are available on request —hello@draaftly.com. If your procurement team has a questionnaire, send it over and we will answer it as it stands today, including where the answer is “not yet”.
Questions your security team needs answered?
Send them over. We would rather have the hard conversation before you sign than after.