Trust center

Our compliance information brings together independent assurance and applicable privacy responsibilities. Each framework has its own scope. Review the relevant report, certificate or agreement in the context of the service you plan to use.

For organizational reviews, contact us about documentation, data processing agreements and specific requirements. Healthcare workflows require discussion of the applicable business associate agreement and approved features before protected health information is uploaded.

A procurement review starts with the service boundary: the workspace, the features enabled and the information an organization plans to process. We align the applicable processing agreement with that boundary and review additional requirements before a regulated workflow is enabled.

Our vendor review considers the purpose of processing, the provider’s assurances, contractual safeguards and international transfers. A data protection impact assessment or an additional agreement may be needed for a particular use case; a general compliance badge does not resolve those questions.

Server connections to configured cloud providers use HTTPS. Private records and files are protected through application permissions and storage policies. Stored integration credentials use application encryption where the integration requires it.

Processing a document can require the service or a selected provider to read its contents. Citation does not describe this as encryption that keeps content unreadable to every service provider. Retention and recovery requirements should be assessed for the applicable provider configuration.

Data in transit uses HTTPS and TLS. Our core hosting and database providers document AES-256 encryption for stored data. Supported integration credentials receive separate AES-256-GCM application encryption before storage, with the key held in server configuration.

Recovery planning distinguishes database records, uploaded files and application configuration. A database backup is not assumed to contain every stored object. Backup access is restricted, and restoration planning includes checking permissions and reconciling changes made after the recovery point.

Protected operations check the authenticated user and relevant workspace or document permissions. A document guest is not automatically a member of its wider workspace. Public sharing is a separate choice and grants access to the shared view.

MCP authorization and API keys are scoped to a workspace and permitted actions. Account controls support password management and session revocation. Existing access tokens can remain valid until expiry after refresh sessions are revoked.

Our administrative access policy requires individual accounts, the minimum permissions needed for the task and MFA on production management services that support it. Access should be removed when a person’s responsibilities end and reviewed when their role changes.

Customer workspace roles and document permissions are separate from internal infrastructure administration. A customer account does not inherit a provider’s administrative MFA setting. Integration scopes and API keys should be limited to the actions required and revoked when no longer used.

Vercel serves the application. Supabase supplies authentication, database records and file storage. Additional services support AI requests, payments, public page analytics and transactional delivery.

The provider list describes which service receives which kind of information. Region, retention and recovery arrangements depend on the service and its configuration. Contact us when your review requires a specific hosting or residency commitment.

Application hosting, persistent workspace storage and downstream AI processing have different boundaries. A global delivery network does not establish the database’s residency, and a database region does not restrict every downstream provider to that region.

Before agreeing to a residency requirement, map the features involved, the configured primary region, support access and any international processing. The provider table is a starting point for that review; the applicable agreement defines a specific commitment.

Public source retrieval validates destinations and limits responses to reduce exposure to unsafe requests. Webhook delivery requires a public HTTPS destination and blocks private network destinations and redirects.

Browser response headers restrict framing, content type guessing and selected device permissions. The Word companion has a limited framing exception for supported Office hosts. These controls help reduce specific risks without treating external content as trusted.

The hosting platform provides edge traffic protection, including DDoS mitigation. Application checks add authorization, bounded requests and destination validation. These are separate layers: a request reaching the application still needs the right permissions.

For source retrieval and webhooks, an external address is untrusted input. Validation is intended to prevent requests to private networks and unsafe redirect targets, while time and size limits bound the work performed.

Citation validates supported inputs, bounds file processing and checks authorization before changing protected data. Resource and usage limits help control request size and provider capacity across document, AI and integration workflows.

Review suggestions are separate from accepted changes. Sensitive operations keep server credentials outside browser code. If you find a suspected vulnerability, send a concise description using your own account and the smallest safe reproduction.

The development review process considers permissions, input validation, data exposure and failure recovery before a change is released. Dependency and vulnerability findings are assessed by severity, exposure and the affected workflow, with remediation followed by verification.

Security assessment scope includes account boundaries, sharing, uploads, integrations and API authorization. Independent testing documentation and remediation status are discussed through the security review route when relevant to procurement. Tests of Citation do not authorize testing a cloud provider’s infrastructure.

Stripe collects payment details through its own interfaces. Citation uses payment and subscription references to manage the associated account, without collecting full card details through its contact form or ordinary application fields.

Billing changes rely on verified payment events. The service checks the event and its account association before changing entitlements or credits. Support questions should describe the issue without including card numbers or security codes.

Stripe is a PCI DSS Level 1 service provider. Citation’s payment flow uses Stripe’s collection interfaces and identifiers rather than retaining full card numbers or card security codes in workspace records.

A subscription cancellation changes billing renewal; it does not automatically delete the account or its documents. Use the account’s Billing controls for the subscription and Data requests for the separate privacy action.

Operational records help explain request status, usage and failures. Provider usage is recorded for the operations that consume it. API jobs expose status so a client can distinguish an accepted request from a completed result.

Public page analytics uses DataFast in cookieless mode. The integration excludes private workspace paths, account details and document contents. When reporting a problem, provide an error reference and approximate time rather than private tokens or full document content.

Our operational review uses request status, error references, usage and relevant access records to investigate failures or suspected misuse. Access to diagnostic material follows the same need to know principle as other production information.

Logging should avoid document bodies, private tokens and unnecessary personal information. An investigation records the affected service, timing, scope and response. Provider uptime notices help identify infrastructure incidents but are not a guarantee that every application workflow is available.

If you suspect an incident, protect your sign in method, review sessions and connected services, and contact us promptly. Explain the affected feature and the time observed without including credentials or another person’s private work.

Response can include investigating available records, limiting access, revoking permissions, disabling affected functionality or working with a service provider. Notification requirements depend on the incident and the applicable legal obligations.

The response process is to identify the affected service, assess exposure, contain the issue, recover safely and review its cause. Containment can include revoking credentials, narrowing access, disabling a feature or coordinating with a processor.

Notifications follow the applicable contractual and legal requirements. For a personal data breach, the relevant roles and risk determine who must be notified and when. We preserve the information needed to investigate and explain confirmed impact without disclosing another customer’s data.

Security depends on the people who use and operate the service as well as application controls. Protect account credentials, review access roles and limit sharing to the intended audience. On a shared device, account for locally stored recovery data before leaving a session.

Security research must use accounts and information you control or have explicit permission to test. Stop if you encounter another person’s data and report the issue without copying it. Citation’s reporting process does not authorize testing of a provider’s infrastructure.

Our personnel security policy covers confidentiality, acceptable use, handling of customer information and reporting suspected incidents. Onboarding establishes responsibilities and access; a change of role or departure triggers a review of permissions and credentials.

Security awareness covers phishing, credential protection, document sharing and the safe use of AI tools. Personnel should use only authorized systems for customer information and report mistakes promptly so access can be contained and the impact assessed.

You can export documents and reference records, review sharing settings and disconnect tools you no longer need. For a privacy request, contact us with the scope of the request and enough information to identify the relevant account.

Deletion, disconnection and export are different actions. Removing an integration does not remove copies already exported to another service. Retention requirements and provider backups may affect when particular records are removed.

Privacy requests move through scope clarification, identity or authority verification, review of the relevant records and a response explaining the result. Shared organization content can involve an additional data controller with its own responsibilities.

Document exports are available in supported formats. A wider account export or erasure request may include records outside a single document, such as support messages or billing references. Legal retention and backup handling are considered separately from active workspace deletion.

Different service providers support different parts of Citation. A source lookup can send a title or identifier to a research database; a writing request can send document context to an AI provider. A catalog entry alone does not connect a third party to your account.

Review the provider list and the permissions shown when connecting a tool. Contact us about the agreements, locations and transfer arrangements applicable to your planned use. Downstream processing can depend on the model or feature selected.

Provider selection considers the service required, data categories, access needs, security documentation, retention and transfer arrangements. An executed data processing agreement and any relevant transfer mechanism need to match the service being used.

A provider change is reviewed for its effect on the workflow and existing commitments. Optional integrations remain subject to their own permissions and terms. Send a vendor questionnaire through the contact route to discuss a requirement that is not covered by the public information.