Security

§ 1

Certifications

Citerra holds no third-party security certification today. SOC 2 Type II and ISO 27001 are independent audits, and neither has been run. HIPAA is United States health law and does not apply to this service.

That is stated first rather than left out. When an audit starts, this section will name it and date it, and the report will be available here when it lands.

What Citerra can substantiate is below, and every item is a property of how the service is built. Where something is planned rather than built, this page says so.

§ 2

Where your work is stored

Some providers process one slice of the data outside the EU. The subprocessor register names each one, what it receives, and where it operates, and it is the same register the privacy policy renders.

Documents and library

The application database, your documents, your sources and the PDFs Citerra generates are hosted on a Convex deployment pinned to the EU, in Ireland.

Compilation

LaTeX compiles in the EU, in Frankfurt, on machines that hold no state. Your sources are deleted with the container when the job finishes. The compile service is never reachable from a browser: it is called server to server over signed internal URLs.

Uploads

Uploaded PDFs and images are stored by UploadThing in the United States. Files are served through short-lived signed URLs and are not publicly listable.

Sign-in identity

Your email address, name and organization membership are held by Clerk in the United States. Citerra mirrors the identity it needs and stores no password.

§ 3

What the model sees

Citerra never uses your work to train a model. Not your documents, not your sources, not your conversations, and not in aggregated form. It is a commitment rather than a setting, so no update can reverse it quietly.

When the assistant answers, only the passages relevant to that question are sent to the model provider. Your library never leaves Citerra in full.

The provider's API terms exclude API content from training. The provider may retain it in abuse-monitoring logs for up to 30 days, unless the law requires longer. Citerra is not approved for zero data retention, which would remove that window.

An organization can point Citerra at its own model endpoint, in which case answers are generated there instead. That endpoint's API key is stored in Convex, readable only through an internal function that no public function returns. It is sent only to your own endpoint, never logged and never sent to Sentry. Deleting the override deletes the key.

An organization admin can turn AI off entirely, which stops new AI processing across the organization.

§ 4

Who can reach what

Scope is enforced in the function that serves the data, not in the interface that requests it. Three of those rules are lint rules that fail the build rather than conventions somebody has to remember.

Every function checks

Each Convex query, mutation and action calls requireAuth and then requireOrgScope before it touches organization data. A function that forgets is a lint error (@citerra/require-auth, @citerra/require-org-scope), so it cannot reach a deployment.

Retrieval cannot leave a document

The assistant retrieves only from the library of the document it is open in. Library search is reachable through one function, and a call without a documentId filter is a lint error (@citerra/rag-must-filter-docid). No setting widens it.

Sign-in

Email, Google and GitHub, through Clerk. SAML single sign-on, SCIM provisioning, custom roles and an audit log are part of the Enterprise edition.

Internal access

Access to production follows least privilege and requires multi-factor authentication. Developer privileges fail closed. Convex requires a server-only value to equal the exact string true; an absent, blank or malformed value enforces real plans and limits. A production deployment refuses the flag whatever its value.

Bot protection

The waitlist, newsletter and contact forms are behind bot detection rather than a puzzle. The same protection on sign-up, sign-in and password reset is planned and not yet in place.

§ 5

Encryption

Every connection runs over TLS. Each provider that stores your data encrypts it at rest on its own platform. Files are served only through short-lived signed URLs rather than from a public bucket.

Requests to third parties leave through one HTTP wrapper with a timeout and bounded retries. A direct call that bypasses it fails the build, which is what keeps timeouts, logging and error reporting in one place.

§ 6

What is logged

Error reports carry a stack trace with personal data removed. Request bodies and document content are never logged, and application logs identify a paper by its id rather than by its contents.

Session replay is switched off on the editor. A replay of the writing surface would record an unpublished paper keystroke by keystroke, so that surface records nothing. Input masking is on by default everywhere else.

Model-request metadata contains model names, token counts, latency and identifiers, never prompt or response text. It is kept for 90 days for security, billing and service measurement.

§ 7

How changes reach production

Every change is reviewed and every boundary above is enforced by a check rather than by a habit. 19 fitness tests fail the build. They cover authentication on every backend function, the direct-fetch ban, the compile-service call-site restriction, one-direction UI layering and the ban on cross-feature imports. Retrieval scoping is enforced separately, by the lint rule named above.

The developer tools that can override a plan are an empty component in the checked-in source. Only the development server substitutes the real drawer, and a post-build guard rejects any production client bundle that contains it.

Secrets are scanned for on every commit. Credentials are never committed, and the environment values that hold them are readable only by the deployment.

§ 8

Leaving Citerra

Nothing here is designed to keep you. The document is LaTeX and BibTeX, and an export written today opens in any editor with or without Citerra.

Export

Any paper exports as .tex and .bib at any time. An organization admin can export the whole organization as a zip. Prepared bundles are removed within 24 hours.

Deletion

Deleting an organization removes its documents, uploaded files and search indexes after a 30-day grace window. The deletion can be cancelled at any point inside that window.

AI data

Turning AI off stops new AI processing. Conversations, generated analysis and search indexes already stored are deleted separately by an admin, so nothing disappears by surprise.

Backups

The database platform keeps its own backups. Citerra does not publish a recovery time objective yet, and will not claim one before it is measured.

§ 9

Reporting a vulnerability

Write to security@citerra.de with what you did and what happened. A report made in good faith will not be met with a legal response.

Do not run tests that degrade the service for other people, and do not access an organization that is not yours. Everything else is welcome, including reports about this page.