Security

All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (HTTPS). Documents uploaded for processing are encrypted at rest using AES-256 encryption. API keys and sensitive credentials stored in our system are encrypted with application-level encryption before being written to the database.

Deadline Pilot is hosted on Render, a SOC 2 Type II certified infrastructure provider. Our servers run in secure, managed environments with automatic security patches and updates. The database has Render's continuous point-in-time recovery, and a full logical dump is taken nightly and stored in our Cloudflare R2 bucket — a second provider, so a failure at either one does not take both copies. We do not currently replicate that dump to a second geographic region.

User authentication is handled by Clerk, an enterprise-grade identity platform. Clerk provides secure session management, multi-factor authentication support, and protection against common attacks like credential stuffing and brute force attempts. Passwords are hashed using bcrypt with industry-standard salt rounds.

Court documents uploaded to Deadline Pilot are processed securely. Document text is extracted server-side and sent to our AI provider (OpenAI or Anthropic, as listed on our sub-processors page) for deadline analysis. Unless that step is switched off, every page of each uploaded PDF, scanned or not, is rendered as an image and sent to Google Cloud Vision for text recognition. Processed documents are stored securely and can be deleted at any time by the user. We do not share your documents with any third parties beyond the sub-processors needed to provide the service.

Extraction data is retained based on your subscription plan. Free-tier users have 7-day retention, Premium users have 30-day retention, Professional users have 365-day retention, and Firm accounts keep data for the life of the account. You can manually delete your extraction history at any time from the History page. Deleted data is removed from view immediately and permanently deleted, including from object storage, within 14 days. Database backups are kept for up to 30 days, so deleted data can persist in a backup for up to 30 days after it is deleted.

Deadline Pilot uses a small set of vetted sub-processors to deliver the service. The complete list, the purpose of each, and the type of data each receives is published on our sub-processors page. We will notify customers of any new sub-processor before it begins processing customer data.

Only NeuralSoft engineers with a documented operational need have access to production systems. Access is gated through Render's role-based controls and audited via Clerk and Render's activity logs. Database credentials and encryption keys are stored in Render's encrypted secret store; AI provider keys are stored in our database, encrypted by the application. Neither is ever kept in source control. Access is reviewed when it changes — when someone joins, leaves, or no longer needs a system. We are not yet running the scheduled quarterly review this page previously described, and we will say so here when we are.

Security- and account-relevant actions — account deletion, administrator changes to user accounts, team membership and role changes, a subscription you cancel in the app, disputes on credit-pack purchases and their outcome, and promo-code use — are recorded in an audit log that the database prevents from being edited or deleted (INSERT-only enforcement). Routine work on your documents (uploads, edits and deletions) is not individually audit-logged, and neither are changes made in the Stripe billing portal (including a cancellation there) or disputes on subscription payments. Audit entries include the actor, the action and the time. Audit-log entries are kept indefinitely; entries older than 90 days are also copied nightly to encrypted object storage. Ordinary application logs are not archived; they follow our hosting provider's 30-day retention. If your matter requires longer retention of either, write to privacy@deadlinepilot.com before you rely on it.

In the event of a security incident affecting customer data, we commit to:

• Notify affected customers within 72 hours of confirmed compromise.
• Provide a written description of what happened, what data was affected, and remediation steps.
• Publish a public post-mortem after material incidents (with sensitive details redacted).
• Cooperate fully with customer security reviews and any required regulatory notifications.

Detection today rests on a synthetic health check that runs every five minutes and emails the operator when the service or one of its providers fails. We do not yet run automated detection of authentication or data-exfiltration anomalies.

The production database is backed up automatically by Render with point-in-time recovery within the past 7 days. We perform a periodic restore drill against a throwaway local database to verify the restore procedure works end-to-end — most recently on 2026-09-10, which restored the previous night's dump and verified all 37 tables against production row counts. Uploaded documents are held in a single Cloudflare R2 bucket; they are not currently replicated to a second R2 region.

Deadline Pilot is not currently SOC 2 certified. We have committed to pursuing SOC 2 Type II readiness once we reach 50 paying customers, which is the threshold at which the formal audit cost becomes cost-effective for the customer base. In the interim, we implement and document several of the operational controls SOC 2 requires (immutable audit logging, incident response, encryption at rest and in transit) so the readiness gap is small when we begin the formal audit. Scheduled access reviews are not running yet.

Reporting a vulnerability

If you discover a security vulnerability, please email security@deadlinepilot.com with reproduction steps, or start from our machine-readable contact at /.well-known/security.txt. We aim to acknowledge within one business day and provide a remediation timeline within five business days. We do not currently run a paid bug-bounty programme, but we credit researchers who would like attribution on our acknowledgements page.