Desktop Security at Draftable.

Here you'll find security information about all of Draftable’s desktop application products and offerings.

Read the technical detail

Your documents never leave your machine.

Draftable Legal, Draftable Business and Draftable Clean are desktop applications. The comparison engine runs on your computer. Your documents are not uploaded to Draftable, and they are not sent anywhere to be compared.

Where your documents are processed.

Locally, on your machine. Documents are read from local disk, network shares, or your document management system, and every stage of conversion, comparison, and rendering happens on your machine. Outputs are written back to locations you control.

Our Document Management System integrations connect the application directly to your own DMS. Files move between your DMS and your machine, authenticated by your own identity controls. They do not route through Draftable.

How your data is protected.

Because your documents stay with you, they are protected by your own security controls. The application itself makes only a small number of outbound connections, and none of them carry document content:

Telemetry collects no Personally Identifiable Information (PII). It is not linked to individual users, licences, IP addresses, or organisations, and it is never used for sales or marketing. We use it exclusively to understand how our products are being used to help with prioritising product improvements. Users can disable it in the product settings and administrators can disable it centrally through policy controls.

If our support team ever needs to see a file to diagnose a problem, sending it is always your choice. The application can scramble document content first so we can see the structure without the text, and administrators can disable sharing of files with our support team entirely.

How long we keep it.

We do not hold your documents, so there is nothing to retain.

Certifications and
compliance.

ISO/IEC 27001:2022 certified, SOC 2 Type II attested, and GDPR compliant. See our full security and compliance program.

FAQs

Can we control where our data is hosted?

Accounts created through draftable.com are hosted in our US data centre. We also operate an EU data centre and can provision your account there on request. Other regions are possible where there is enough customer commitment to support the deployment. Talk to us about your requirements.

Do you use our documents to train AI?

No. Our comparison algorithm is deterministic and rules-based, with no machine learning involved. We do not use documents submitted by our commercial customers to train any model, and we will not.

Can we run our own penetration test?

Yes, after obtaining written consent and mutual agreement on the penetration testing scope. If you self-host, the deployment is yours to test.

Trusted by 1300 law firms and legal teams globally.

Join 1,300+ legal teams using Draftable.
Get started for free.