Security at Quotehold

Quotehold is built for law firms, so confidentiality is the starting point of the design, not an afterthought. This page describes, in plain language, how your documents and research are protected.

Your firm gets a dedicated, isolated deployment

Quotehold is not a shared pool. Each firm runs on its own private instance with its own database and its own document storage. Your documents are never stored alongside another firm’s, and no other customer’s instance can reach your data.

Encryption everywhere

• In transit: all traffic uses TLS — between your browser and Quotehold, and between Quotehold and every service it relies on.
• At rest: the database and document storage are encrypted at rest by the underlying infrastructure providers.

AI providers never train on your data

Quotehold uses Anthropic’s Claude to draft answers. Under Anthropic’s commercial terms, API data is not used to train models, and inputs and outputs are automatically deleted from Anthropic’s systems within 30 days. Our embedding provider is contractually opted out of using customer data for training. Document parsing runs with caching disabled, so uploaded files are not retained on the parser’s servers after processing.

Verified answers, not just plausible ones

Every answer is machine-checked before you see it: each citation’s quote is verified against the actual source text, and any citation that cannot be verified is removed. Fabricated references never reach your screen — this same pipeline is what makes prompt-injection attacks against the research corpus ineffective.

Access control

• Every request is authenticated; sessions are signed and short-lived.
• All data access is scoped to your firm at the database-query level.
• Login and API endpoints are rate-limited against brute-force attempts.
• Strict browser security headers (CSP, HSTS, clickjacking protection).

Your data stays yours

You can delete documents or entire research threads at any time, and deletion is immediate and permanent. When an engagement ends, we delete your instance and all of its data on request.

Questions

Security questionnaire, or something this page doesn’t cover? Email dhruval@ryplix.com and you’ll get an answer from the team that builds the product.