Trust & Compliance

Dossier is built as a private, need-to-know evidence workspace. Every workspace is isolated at the database level, access is authenticated and logged, and content is only visible to users you explicitly invite.

We encrypt data in transit with TLS 1.2+ and at rest using the encryption provided by our cloud infrastructure. Operational logs capture sign-ins, uploads, exports and administrative actions so your workspace remains auditable.

Our SOC 2 Type II report is available upon request under a mutual non-disclosure agreement. If you need a copy for your vendor diligence process, contact us at support@dossierplus.ai.

For customer personal data processed through the Dossier service, we act as a processor. A Data Processing Addendum is available upon request and can be executed alongside your workspace agreement.

You control what you upload, who has access, and when data is deleted. You can delete files, matters, projects, workspaces and your full account from inside the app. Billing records may be retained where required by law.

Dossier uses OpenAI and Anthropic as governed AI subprocessors to extract dates, entities, claims and summaries from uploaded documents, and to generate analysis such as storylines, diligence questions and memos.

Your content is not used to train third-party models. Processing is performed under zero-retention agreements where available, and customer data is handled in US regions.

You should not upload data you are not authorised to process, and you remain responsible for the lawfulness of the content you submit.

Our current subprocessors include our cloud hosting and database provider, authentication services, payment processor (Stripe), email delivery provider, and the AI providers listed above. If you need the current subprocessor list or notice of changes, email support@dossierplus.ai.

For compliance questions, report requests, or security incidents, contact support@dossierplus.ai.