> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antlect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Centre

> Security, privacy, and compliance at Antlect. Your research intelligence is protected at every layer.

Antlect is built for organisations that make decisions on research intelligence. Every part of the platform, from sign-in to storage to analysis, is designed with security, privacy, and data isolation as defaults, not afterthoughts.

## Compliance

We are implementing the controls and practices defined by the following security and privacy frameworks. See each framework below for details on how these practices are implemented.

<CardGroup cols={2}>
  <Card title="GDPR" icon="scale-balanced">
    **Practices implemented.** Data subject rights honoured on request (access, correction, deletion, and portability) with a designated privacy contact.
  </Card>

  <Card title="ISO 27001" icon="award">
    **Practices implemented.** Our security controls follow ISO 27001 principles: access control, encryption, logging, and least privilege. Formal certification is planned.
  </Card>

  <Card title="Australian & NZ privacy law" icon="flag">
    **Aligned.** Antlect serves Australia and New Zealand first, with practices aligned to the Australian Privacy Principles (APPs) and the NZ Privacy Act 2020.
  </Card>
</CardGroup>

<AccordionGroup>
  <Accordion title="Our GDPR practices">
    What we implement today:

    * Data subject rights (access, correction, deletion, and portability) honoured on request via [hello@antlect.com](mailto:hello@antlect.com).
    * Data minimisation: the personal data we hold is limited to your account profile and the content you create in your workspaces.
    * No sale of personal data, and no use of your content to train AI models.

    <Note>
      The full GDPR statement (lawful bases, retention schedule, and response SLA) is being finalised and will be published here.
    </Note>
  </Accordion>

  <Accordion title="Our ISO 27001 practices">
    What we implement today:

    * Role-based access control enforced at the API layer.
    * Encryption in transit on every connection; encrypted managed storage at rest.
    * Audit logging of key account and content lifecycle actions.
    * Rate limiting, hardened HTTP security headers, and input sanitisation on all user-supplied content.

    <Note>
      The full control mapping against ISO 27001 Annex A is being prepared and will be published here, along with our certification timeline.
    </Note>
  </Accordion>

  <Accordion title="Australian Privacy Principles & NZ Privacy Act 2020">
    What we implement today:

    * Customer file storage hosted in AWS ap-southeast-2 (Sydney), keeping data close to the Australasian organisations we serve.
    * Collection limited to what the platform needs to operate; clear channels for access and correction requests.

    <Note>
      Operating legal entity details and the full APP/NZ Privacy Act statement are being finalised and will be published here.
    </Note>
  </Accordion>
</AccordionGroup>

***

## Security overview

<CardGroup cols={3}>
  <Card title="Encryption" icon="lock">
    All traffic is encrypted in transit with TLS. Data at rest lives in managed database and object storage with provider-managed encryption. No unencrypted paths exist.
  </Card>

  <Card title="Workspace isolation" icon="shield-halved">
    Every workspace is scoped to its owner and enforced on every API request. No cross-workspace data access is possible.
  </Card>

  <Card title="Audit logging" icon="clock-rotate-left">
    Key lifecycle actions (creates, deletes, restores, and password reset requests) are logged with who, what, and when, and are visible in **Settings > Security > Audit logs**.
  </Card>

  <Card title="Session management" icon="right-from-bracket">
    Sign-in is handled by a dedicated identity provider. Every API request re-verifies the token's signature and expiry server-side. Antlect never stores your password.
  </Card>

  <Card title="Role-based access" icon="users-gear">
    Two roles, user and admin, with the hierarchy enforced at the API level. Access to the platform itself is granted through admin-reviewed access requests.
  </Card>

  <Card title="AI data handling" icon="microchip">
    Your content is processed to answer your queries and nothing more. **Your data is never used to train AI models.**
  </Card>
</CardGroup>

Beyond the fundamentals above, the platform ships with defence-in-depth hardening:

* **Rate limiting** on every route, with stricter per-route limits on public-facing endpoints such as access requests and support.
* **Strict security headers** and CORS locked to the Antlect application origin.
* **Input sanitisation** on all rich-text content before it is stored or rendered.
* **Safe error handling**: internal errors are never leaked to clients in responses.
* **Upload limits** on all file endpoints to prevent abuse.

***

## Compliance & data protection

<CardGroup cols={2}>
  <Card title="GDPR practices" icon="scale-balanced">
    Full data subject rights (export, deletion, and portability) honoured on request through our designated privacy contact. A formal response SLA will be published with our full privacy policy.
  </Card>

  <Card title="Australian & New Zealand privacy" icon="flag">
    Operated for the Australasian research sector, with customer file storage in AWS ap-southeast-2 (Sydney) and practices aligned to the Australian Privacy Principles (APPs) and the NZ Privacy Act 2020. *Operating entity details to be published.*
  </Card>
</CardGroup>

The personal data Antlect holds about you is deliberately small: your account profile and the content you create in your workspaces. The research corpus Antlect analyses (publications, patents, funding, and clinical trials) is public scholarly data about research activity, not customer data.

### Your data rights

* **Export**: request a complete copy of your personal data by emailing [hello@antlect.com](mailto:hello@antlect.com). Self-serve export from Settings is on the roadmap.
* **Correction**: your profile fields are editable at any time in **Settings > Profile**.
* **Delete**: request permanent removal of your account and all associated data via [hello@antlect.com](mailto:hello@antlect.com). Self-serve deletion from Settings is on the roadmap.
* **Privacy contact**: reach our privacy team at [hello@antlect.com](mailto:hello@antlect.com). A designated Data Protection Officer will be announced with our full privacy policy.

***

## Infrastructure & sub-processors

Antlect runs on managed, reputable infrastructure. Customer file storage is hosted in **AWS ap-southeast-2 (Sydney)**, keeping data in the region we serve. The following third-party services process data on Antlect's behalf:

| Sub-processor       | Purpose                           | Data processed                                                           | Location                |
| ------------------- | --------------------------------- | ------------------------------------------------------------------------ | ----------------------- |
| Auth0 (Okta)        | Identity & sign-in                | Email, name, credentials (held by Auth0, never by Antlect)               | *To be published*       |
| Amazon Web Services | File & asset storage (S3)         | Uploaded files and report assets                                         | ap-southeast-2 (Sydney) |
| Managed PostgreSQL  | Primary application database      | Workspace content and account data                                       | *To be published*       |
| Neo4j Aura          | Research graph database           | Public research data: researchers, publications, patents, funding        | *To be published*       |
| Resend              | Transactional email               | Name, email address, and message content for support and access requests | *To be published*       |
| Mintlify            | Documentation hosting (this site) | No customer data                                                         | United States           |

<Note>
  A data processing agreement (DPA) register covering each sub-processor is being prepared and will be published here. Need a DPA in the meantime? Contact [hello@antlect.com](mailto:hello@antlect.com).
</Note>

***

## Policies & documentation

<CardGroup cols={2}>
  <Card title="Data privacy" icon="eye-slash" href="#security-overview">
    Encryption, workspace isolation, access controls, deletion, and your data rights, the full technical breakdown.
  </Card>

  <Card title="Sub-processors" icon="building" href="#infrastructure--sub-processors">
    Complete list of third-party services that process data on behalf of Antlect, with DPA coverage.
  </Card>

  <Card title="Cookie policy" icon="cookie-bite" href="/legal/cookie-policy">
    What cookies Antlect uses, why, and how to control them.
  </Card>

  <Card title="Audit logs" icon="clock-rotate-left" href="#security-overview">
    Track the key actions on your account (who did what, and when) from Settings.
  </Card>

  <Card title="Password & security" icon="lock" href="/account/authentication">
    How sign-in works, and how to manage your password and account security settings.
  </Card>

  <Card title="Privacy Policy" icon="scale-balanced" href="/legal/privacy-policy">
    Full legal privacy policy: how we collect, use, store, and protect your personal data.
  </Card>

  <Card title="Terms of Service" icon="file-contract" href="/legal/terms-of-service">
    Terms governing your use of the Antlect platform.
  </Card>
</CardGroup>

***

## Questions?

If you have security questions, need a DPA, or want to report a vulnerability, contact us:

* **Privacy & data protection:** [hello@antlect.com](mailto:hello@antlect.com)
* **General support:** [support@antlect.com](mailto:support@antlect.com)

We take vulnerability reports seriously. A formal responsible disclosure policy is being prepared and will be published here.