Draftable API security
Enterprise-grade security, you control the data lifecycle.
The Draftable API is our cloud-hosted comparison service. Documents you submit are processed on our infrastructure, and you decide how long they stay there.
Where your documents are processed
Your documents are processed on our cloud infrastructure hosted by Amazon Web Services, using Amazon S3 for document storage and Amazon RDS for application data.
If you need documents to stay inside your own network, Draftable API Self-Hosted runs the same comparison engine and can be deployed on your own infrastructure.
How your data is protected
- Encrypted in transit with TLS 1.2 or 1.3
- Encrypted at rest with AES-256
- Independently penetration tested, covering both the web application and the API
How long we keep it
You decide. Data you submit is retained until you remove it, and the API gives you three ways to control that:
- Set an expiry when you create a comparison and it will delete itself automatically
- Delete on demand with a single API call or SDK method
- Control link validity separately, so a viewer link can expire without deleting the underlying data
When a deletion is processed the data becomes immediately inaccessible. Copies in encrypted backups age out automatically within 30 days.
Certifications and compliance
ISO/IEC 27001:2022 certified, SOC 2 Type II attested, independently penetration tested, and GDPR compliant. See our full security and compliance program
Common questions
Accounts created through draftable.com are hosted in our US data centre. We also operate an EU data centre and can provision your account there on request. Other regions are possible where there is enough customer commitment to support the deployment. Talk to us about your requirements.
No. Our comparison algorithm is deterministic and rules-based, with no machine learning involved. We do not use documents submitted by our commercial customers to train any model, and we will not.
Yes, after obtaining written consent and mutual agreement on the penetration testing scope. If you self-host, the deployment is yours to test.