Agmt Verbatim

Security architecture · implementation evidence

Documents processed without application content logs.

Agmt Verbatim is designed to parse document bytes in Worker memory. Application logs and databases contain allowlisted operational metadata rather than document text. This describes the application design and local checks; the production account configuration and retention monitoring have not yet been verified.

Document handling

  • Direct parse requests are handled in Worker memory. The CI canary test checks local Worker logs and emulated D1/R2 for a unique source string.
  • Optional browser upload encrypts the file in the browser with AES-GCM. The service receives an envelope and stores only ciphertext in transient object storage.
  • Upload access ends after 15 minutes. Physical deletion is asynchronous. A maximum deletion deadline is a release gate and is not verified for this deployment.
  • The service records account and operational metadata such as email addresses, API key hashes, upload expiry state, keyed pseudonymous client identities and document-deduplication hashes. These records are distinct from document plaintext.
  • The deterministic parser makes no LLM calls and does not fetch images or linked templates.

Application controls

  • One allowlisted logger emits request IDs, fixed route labels, status, tier, opaque key hash, timing buckets and fixed error codes. URL query strings are not recorded.
  • Archive expansion, XML parsing, recursion, and work budgets are bounded. External relationships are not followed.
  • Upload envelopes use an authenticated encryption tag and bind ciphertext to the upload ID. Upload handles expire and are one-use.
  • Local test coverage includes expiry, one-use writes, wrong-key rejection, deletion, and a unique plaintext canary.

Production log sampling, export settings, access controls, deletion monitoring, and owner alerting remain to be verified before release.

Service providers and scope

The product design uses Cloudflare for Worker compute, D1 operational metadata and encrypted temporary upload storage. Resend is used for API-key magic-link email addresses. Production configuration and provider agreements must be reviewed before this list is treated as complete.

Processing is designed to happen at the nearest available Cloudflare location. The service does not claim region pinning, SOC 2 or ISO 27001 certification.

For personal-data handling, see the privacy draft and data processing agreement draft. Both require owner and counsel review.