Security & Trust

Encryption in transit and at rest

All traffic to SEPPi is served over HTTPS. Passwords are never stored in plain text, and account data is held in Supabase's managed, encrypted Postgres infrastructure.

Data minimization

We collect only what authentication, report generation and payment need — the patent numbers you look up, the specifications you upload, the reports produced and your payment records. The privacy policy has the detail.

Specifications you upload

An unfiled specification is kept in private storage and opens only from your own account. The specification and its analysis are used for your own report and nothing else. While a report is being produced, a copy of the specification exists on the analysis server. That copy is deleted once the report is finished, and the uploaded file itself is destroyed when you delete your account. What is sent to outside processors for the analysis is described under “Outside processors” below.

Access control

Row-level security policies ensure your reports and payment history are only ever accessible to your account. Administrative access is limited to designated staff.

Third-party processing

To produce a report, patent claim text (including the claims of an unfiled specification you upload) and excerpts of the cited specifications are sent to the Anthropic Claude API for analysis, and patent numbers are sent to SerpApi (Google Patents) for lookup. An unfiled specification has no patent number, so nothing about it goes to SerpApi. These providers are contractually bound to handle the information securely. The privacy policy lists the processors that handle personal information.

Payments

Card details are never stored on SEPPi's servers. Payments are handled directly by NicePay or PayPal, PCI DSS-compliant payment processors.

Report a concern

If you have a security question or want to report a vulnerability, contact us at info@seppi.xyz.