Data Security.

In short

Need something to forward? The data-handling statement in the app is the short version of this page, with a paragraph you can send to a sponsor.

Architecture & hosting

The Asthra service is delivered as managed Software-as-a-Service. The platform — including the Microsoft Word add-in, the drafting agent, the citation graph, and the audit ledger — runs on cloud infrastructure operated by Amazon Web Services in the US-East (Virginia) region.

Data residency. Customer data is hosted in the United States for now. EU hosting can be arranged where your organization requires it. Email info@asthra-writer.ai and we will take it from there.

Encryption & transport

• In transit — all client-to-service and service-to-service traffic is transmitted over HTTPS, including the Word add-in to backend channel.
• At rest — encryption at rest provided via cloud-native (AWS) managed encryption.

Human access to customer content

• Uploaded content is processed by the Service. Asthra personnel do not access or review user-uploaded documents in the normal course of operating the Service.
• Where direct access is required for support — for example, to reproduce a customer-reported issue — it is gated by an explicit, customer-approved support ticket.

AI-specific controls

Standard cloud-security hygiene is necessary but not sufficient for an AI system in regulated workflows. The controls below are additive.

• Closed-system retrieval by default — the drafting agent has no unattended path to external sources; any internet lookup requires explicit writer approval per request and is recorded in the audit ledger.
• No model training, zero data retention — uploaded content is not used to train any model, ours or anyone else's. Drafting sends the passages a section needs to Anthropic or OpenAI. Both are under zero-data-retention agreements: nothing is stored after the response, and nothing is used for training.
• No human review of customer content — Asthra personnel do not access or review user-uploaded documents in the normal course of operating the Service.
• Provenance enforcement — every generated assertion is bound to a retrieved passage and recorded in the citation graph.
• Gap surfacing — missing data triggers explicit, ledger-recorded gap flags rather than plausible-sounding text.

Subprocessors

We share limited data with the trusted service providers below, under written agreements that require confidentiality and data-protection commitments equivalent to ours.

These five companies are the only ones that handle customer data on our behalf. We add or remove subprocessors only with appropriate diligence, and any change appears on this page. The data-handling statement in the app carries the same list in a form you can forward.

Retention

• Uploaded source documents — kept in the customer's library until the customer deletes them. There is no automatic purge, by design: a protocol uploaded for one document is usually needed for the next. Deleting a source removes it from the library.
• Drafts — kept with their document. Deleting the document deletes its drafts.
• Account data (name, email, payment history) — kept for as long as the account exists; deleted within one month of account closure.
• Audit ledger — embedded in the document delivered back to the writer; lifetime of the document.

Incident response

In the event of a security incident affecting customer data, we will:

• Investigate and contain the issue promptly.
• Notify affected users without undue delay, where required.
• Implement corrective measures to prevent recurrence.

Cookies & sessions

We do not use tracking cookies. Minimal session-based mechanisms are used to maintain user sessions and ensure platform functionality.

Sensitive personal data

Asthra AI does not intentionally collect sensitive personal data — financial details, health information, or government identification numbers. Users should avoid uploading sensitive personal data unless necessary and permitted.

Your data protection rights

You have the right to access, correct, delete, restrict, and object to processing of your personal data, and to withdraw consent. We respond to verified requests within one month. Contact support@asthra-writer.ai.

Shared responsibility

Security is a partnership. Asthra's responsibilities and the customer's responsibilities are defined explicitly so each side knows what it owns.

Contact

Security and data-protection questions:

Data Protection Officer: P Guruprasad
Email: support@asthra-writer.ai