Redlining, Secured
How Version Story protects your privileged and confidential legal documents, with enterprise-grade security practices and infrastructure.
Vulnerability disclosure policy
SOC 2 Type 2
Independent Penetration Testing
Continuous Security Scorecard Monitoring
Modern TLS Configuration
Cyber Insurance
Audit Logs
Protected at
Every Stage
Security
Version Story safeguards your confidential documents at every stage with advanced encryption, rigorous compliance standards, and proactive security monitoring. Protecting your sensitive information isn't optional—it's foundational to everything we do.
What Touches
Your Documents
Law firms put privileged drafts through Version Story. Here is exactly what happens to them, and what does not.
A deterministic engine, not a model
The redline is computed by Version Story’s rules-based comparison engine, written in Rust. No language model reads your documents to produce it, and nothing about their contents is logged for AI. Version Story is not an AI application. It is an application that AIs and people can use.
Never used for training, never read by a person
Nothing you upload is used to train or improve any model, ours or anyone else’s. There is no human review step: no reviewers, no contractors, no crowd workers. Staff access is role-based and recorded in audit logs.
Deleted on your terms
In the app, documents stay in your workspace until you delete them, and admins can set automatic deletion for inactive projects. Through the API, your organization can turn on zero-day retention: the source documents, the redline, and every rendering are permanently deleted within an hour of the comparison finishing, or the moment you acknowledge the download. Only the record that a comparison existed remains. Deleted documents remain only in encrypted backups, which expire on a fixed schedule; content under zero-day retention is never backed up.
Processed inside a private network
Comparisons run on AWS inside a private VPC. Files are held in S3 only while they move between services, encrypted in transit and at rest. UK organizations are served from a UK region, and their documents stay there.
AI is off by default. Nothing goes through a model unless your organization asks us to turn on an AI feature, such as AI conversion of scanned PDFs or Analytics reports. Comparison, merge, and version history never do.
Secure Architecture
by Design
Data Encryption
Documents are encrypted over-the-wire via TLS and at-rest via S3’s document encryption system (SSE-S3). Domains use TLS certificates provisioned by AWS Certificate Manager (CM). SSE-S3 encrypts each object with a unique key, using the 256-bit Advanced Encryption Standard (AES-256) to encrypt its objects and keys.
Cloud Infrastructure (AWS)
Our platform is built securely on AWS, adhering to security best practices like principle-of-least-privilege and encryption at rest and in-transit. Our AWS architecture and operational controls have been independently examined against the SOC 2 Type 2 Security criteria to protect your sensitive data.
Access Controls
Our platform employs strict access controls and real-time security monitoring to safeguard your data. Role-based Access Control (RBAC) ensures users only have access to the information required for their role, while audit logs record every action for traceability. Continuous threat monitoring proactively identifies and mitigates potential security risks.
Questions About
Privileged Documents
- Is Version Story safe for attorney-client privileged documents?
- Yes. Version Story compares documents with a deterministic engine, not a model, so your documents are never used to train anything and no person reads them. Through the API, zero-day retention deletes the documents and the redline as soon as you have the result. Firms that need their own confidentiality terms for privileged work can have an agreement with us.
- Does Version Story use AI to compare documents?
- No. The redline is produced by a rules-based comparison engine written in Rust. Claude, ChatGPT, and other assistants can call Version Story, but the comparison itself is deterministic: the same two versions always produce the same redline, and no language model reads the documents to produce it.
- Are my documents used to train a model?
- No. Nothing you upload is used to train or improve any model, ours or a vendor’s. AI is off by default: nothing goes through a model unless your organization asks us to turn on an AI feature, such as AI conversion of scanned PDFs or Analytics reports.
- Does anyone at Version Story see my documents?
- No one reads your documents to produce a redline. There are no human reviewers, contractors, or crowd workers in the process. Access by staff is role-based and recorded in audit logs.
- How long does Version Story keep my documents?
- In the app, until you delete them; admins can set automatic deletion for inactive projects. Through the API, organizations can turn on zero-day retention, under which each comparison’s documents and redline are permanently deleted within an hour of finishing, or as soon as you acknowledge the download. Deleted documents remain only in encrypted backups, which expire on a fixed schedule; content under zero-day retention is never backed up.
- What is zero-day retention, and how do I turn it on?
- Zero-day retention is a per-organization setting for the REST API, on the Developer page in the app. With it on, every new comparison is deleted permanently once you have its result: the source documents, the redline, and every rendering. Deletion happens one hour after the comparison finishes or when you call the acknowledge endpoint, whichever comes first.
- Can we run Version Story on our own servers, or is there an SDK?
- No. Version Story is a hosted REST API and MCP server; there is no SDK and no on-premises version. Zero-day retention is the answer to the data question: with it on, nothing stays on our side once you have the redline.
- Can we sign a separate confidentiality agreement?
- Yes. Our terms of use already cover confidentiality, and firms that want their own agreement for privileged work can have one. Write to security@versionstory.com.
We take security seriously
Have security questions?
Our security team answers questions about the program, the controls, and the audit reports.