Security and data
Understand Avelbid’s access controls, evidence handling and current limitations.
Pilot information · Updated 5 September 2026
Sign-in and separation
Private workspace routes require sign-in. API requests check agency membership and scope records to that agency. Source matching checks the relevant client. The interactive demo uses a separate fictional dataset and never loads a visitor’s real workspace.
Your evidence
Original uploads are stored in object storage; extracted text and records are stored in the application database. Verification, expiry and archive state affect which sources may support an answer. Archiving is not permanent deletion.
AI processing
Only when requested, and after the agency owner enables processing, the question and relevant verified source excerpts are sent to Anthropic. The connection test sends only a fixed test message, not client documents. Secret keys are held in hosting settings and are not returned to the browser.
Limits you should know
No independent security audit, ISO certification, SOC 2 certification or UK-only data residency is claimed. Backup recovery and retention arrangements for real client work need to be agreed and tested before commercial use. Do not upload health data, payment-card details or other sensitive material.
Report a concern
Use the contact form and choose Product question or Privacy request. Describe the issue without including passwords, API keys, personal records or confidential tender material.