How we protect your data
atas.aero Toolkit · the answers to show your lawyer
Last updated: 9 July 2026 · The Privacy Policy is the full
legal statement; this page is the plain-English summary linked from every upload screen.
Sharing lease, contract and engine records is a real decision, and your counsel is right to
ask how the data is protected. Below is exactly what happens before, during
and after you paste or upload — and, so nothing is overstated, each assurance is tagged with
how it is enforced: in code in our software,
in the database by a Postgres control, hosting by
our provider, contract in the NDA/agreement, or
roadmap where we are candid that it is not yet in place.
Before you paste or upload
What leaves your device — stated plainly
- We never keep your original file. The free paste tool stores only an anonymised
scorecard; the data-pack tool never writes your uploaded PDF to our database. in code
- Everything you paste or upload is transmitted in full and unredacted to our servers
and onward to Anthropic's Claude API for processing — nothing is masked or minimised in your browser
first, and for PDFs the original bytes are sent as well as the extracted text. Redact anything you don't
want to transmit before you submit. in code
- If you later choose to keep your data pack, it stores a short verbatim
excerpt (up to 320 characters, a window around each extracted value) so a reviewer can verify the
figure against your wording. Your original file is still not kept; these excerpts are — under the
no-access lock below, on the schedule you choose. in code
- The relevance check that rejects off-topic input is a cost/abuse guard, not a data-protection control.
in code
During processing
Transmission & the AI processor
- The site is served exclusively over HTTPS, and our host sends a one-year HSTS policy
(
includeSubDomains) so browsers refuse to fall back to plaintext after the first visit.
hosting
- Processing is transient: the server assembles the analysis in memory, calls the AI, and
— on the free paste tool — writes only the computed aggregate. There is no raw-text column on that table,
and a continuous-integration test blocks any change that would leak verbatim text into it.
in code
- Analysis and extraction run on Claude, Anthropic's AI model, via its commercial API
under terms that do not permit training on your data and process it only to return the
result. This protection is governed by our contract with Anthropic, not by our source code — we can
provide that term. contract
After — who can see it, and for how long
Access is private by construction
- Your results are unreadable to other customers, anonymous visitors and the public data API:
row-level security on the results table has no read policy for public or ordinary
logged-in accounts, so the API returns them zero rows. in the database
- A data pack you ask us to hold is masked even from ATAS staff — admins and reviewers
cannot see its contents until you release it, enforced by column-masked database views, and every release
is logged against the staff account that made it. in the database
- Read access outside those masked views belongs only to our server-side service key; who holds and
rotates that key is committed in the agreement. contract
The no-access window and deletion
- Hold: if you keep a data pack, it is held for 14 days with no human
access, then deleted automatically unless you ask us to release it. The 14 days is a single enforced
constant, so the wording can't drift from what the database does. in code in the database
- Decline: if you don't, it is scheduled for deletion within 24 hours.
A purge job runs daily. in the database
- Yourself, any time: the confirmation after you keep or decline a pack gives you a
private link — no account needed — to check your data's current status and delete it on the spot.
in code
- Sooner on request: or just email us and we delete it, whatever the clock says.
contract
- Free-tool (Tier-01) results are retained anonymised for quality review and contain no source
documents. in code
One exception, stated up front: if you tick
the optional “help improve the tool” box at the retention step, your run (including the excerpts) is kept
beyond the 14 days, until we curate an anonymised copy — there is no fixed deletion date.
Leave it unticked and the automatic delete/hold deadline applies.
People named in your documents
Engineer names, signatories and similar personal data inside uploaded documents are processed only to
produce your output — never for any other purpose. For that personal data we act as your processor; the
terms are in the mutual NDA and the engagement agreement. contract
What we do not claim
Because your counsel will ask, here is what is not yet true — we
would rather say so than imply it:
- We are not SOC 2 certified and have no independent audit or penetration-test
report to share. Our controls are the technical and contractual ones on this page. roadmap
- We do not redact your document for you — please remove anything sensitive before
submitting. roadmap
- Nothing in our software prevents an ATAS staff member from retaining a document via our internal
demo path; that is controlled by staff confidentiality obligations in the agreement, not by code. contract
Analytics
Aggregate, cookieless page-view measurement only (Vercel Web Analytics) — nothing is stored on your
device and no user-level or cross-site identifier is created. No tracking or advertising cookies. hosting
Questions or complaints
contact@atas.aero — data-protection complaints are acknowledged
within 30 days. You can also contact the UK ICO (ico.org.uk) at any time. AeroFusion Consultants Limited,
trading as atas.aero. Registered in Scotland, Company No. SC825730. ICO registration: C1976476.