Security

The short version

When you’re signed in, your inputs and results are saved to your account so History and your dashboard work. Every row is isolated per user with database row-level security, so one account can never read another’s — and we never sell your content or use it to train models.

How your content is handled

• In transit. Everything travels over HTTPS/TLS.
• At rest.Your inputs and results are stored in our database (Postgres), isolated per user with row-level security so only your account can read them. Interface preferences (panel widths) stay in your browser’s local storage.
• AI processing. Running a tool sends your text to OpenAI to generate a result, which returns to your browser; the AI Detector runs entirely in your browser. See Privacy.

Keys and secrets

Our AI provider key lives only on the server, is never exposed to the browser, and is never committed to the repository. Calls to the model are made server-side from our API route — the browser never talks to the provider directly, so the key cannot be lifted from a page.

Access

Authentication runs through ToolSuite, so CopyLift never sees or stores your password. Session handling is being implemented together with the ToolSuite sign-in.

What we do not claim

CopyLift is in active development. We hold no security certification — no SOC 2, no ISO 27001 — and we will not pretend otherwise. If your organization requires audited controls before you paste sensitive material into a tool, CopyLift is not there yet.

Reporting a vulnerability

If you find a security issue, tell us before telling anyone else, and give us a reasonable window to fix it. Please do not run tests that degrade the service or touch other people’s data.