Data handling and security

Contracts uploaded for analysis are processed in memory and discarded after the report is returned. We never persist the file contents to disk on our servers, and we never train any model on them.

The analysis itself (summary, clause verdicts, citations, estimated fines) is saved to your account so you can revisit past reports. You can delete any report from your account at any time. Deleting your account permanently wipes all reports.

Your questions and our answers are stored in your account so you can resume sessions and reference past responses. The backing database is a self-hosted PostgreSQL instance on our own server, not a shared multi-tenant service. Every query the application makes is scoped to the signed-in user's id, and the API rejects any request for a record the caller does not own.

We do not train models on your conversations. DeepSeek generates the answers and receives your questions and, for a contract analysis, the clause text being assessed. OpenAI has two narrower roles: turning text into the vectors used to search the law library, and reading scanned pages that carry no machine-readable text. Per OpenAI's API data policy, prompts and completions are not used for model training (default for API customers as of OpenAI's data policy).

All traffic between your browser and Mizan is served over HTTPS (TLS 1.2+), and all traffic to our sub-processors uses TLS. The database runs on our own dedicated server rather than a shared service, with operating-system level access restricted to authorized personnel.

Authentication is handled by Firebase Authentication. We support email + password and Google sign-in. Your password is submitted directly to Firebase and never reaches our servers, so we cannot see it, store it, or recover it — password reset goes through Firebase.

You can change your password, set a new one (if signed up via Google), or sign out of every device from Settings → Security. Rotating your password automatically invalidates every active session across all devices.

The Mizan API, the app and the PostgreSQL database all run on a dedicated VPS in Frankfurt (Netcup). Our own infrastructure is therefore EU-hosted. Our AI and payment sub-processors are not: DeepSeek processes data in China, and OpenAI, Stripe, Google and PostHog in the United States. The processors we use are listed in the Privacy Policy.

Stripe handles payment processing — we never see your card number. PCI compliance is delegated to Stripe (Level 1 PCI DSS certified).

Access: Everything we have on you is visible inside the app (chat history, contract reports, profile, billing).

Deletion: Settings → Account → Danger zone → Delete account. This wipes your profile, chat history, contract analyses, and cancels any active subscription. The deletion is permanent and irreversible.

Portability:We don't have a one-click export yet — email contact@sefarai.com and we'll send your data as a JSON archive within a business day.

If you find a security issue, please email contact@sefarai.com before disclosing publicly. We'll acknowledge within one business day and credit you in any fix.

For full legal terms, see our Privacy Policy and Terms of Service.