Security

How Annota protects your account and what you ask. We only state what is true today.

Encryption

• Every connection uses HTTPS (TLS), and browsers are told to use HTTPS only.
• The database encrypts all stored data, including backups, with AES-256.
• Passwords are never stored, only a secure hash of them.

Where your data lives

• The database and sign-in run on Supabase in Singapore. Supabase is SOC 2 Type 2 audited.
• The website runs on Vercel in Singapore. Vercel is ISO 27001 certified and SOC 2 Type 2 audited.
• Annota itself has not been independently certified. The certifications above belong to our hosting providers.

AI and your questions

• Searches and assistant questions go through OpenRouter to an AI model provider.
• We allow only providers that do not store your questions or use them to train AI models (zero data retention).
• Your name, email and organisation are never sent to an AI provider.
• Letters you draft in Templates are not saved on our servers unless you keep them in a project. When you use the AI on a letter, your request and the letter’s text are sent to the AI for that task and are not stored by it.
• When you ask the assistant while working in a project, the project’s name, facts, steps, timeline, dates, notes, saved awards, the titles of its letters and the text of its documents go with your question so it knows the case, through the same zero-retention providers. On the project’s page the assistant can change the project for you (steps, facts, timeline, notes, the name), only that project, never delete it or anything you saved, and what it changes in a turn can be undone in one tap until you ask it something else. A negotiation’s “Your limit” is never sent.

Access

• The data bank is open only to signed-in users.
• Database rules stop any user from reading another user’s account details.
• Projects are private to the person who made them unless they share one with an invite link; the people who join can then see and change it. Every request is checked against your account on our server, and the database refuses the public key outright.
• Each server limits how many searches and assistant requests one person can make a minute, to slow down abuse.

Your data, your control

• Delete your account and its personal data at any time in Settings.
• Search logs and error logs are not linked to your name and are deleted after 12 months.
• No advertising or tracking cookies.

Full details are in the Privacy notice, written under Malaysia’s Personal Data Protection Act 2010.

Report a security issue

Email jchandrasegaran@gmail.com. We will reply as soon as we can and fix confirmed issues promptly.