Trust Center

What happens to your data when you use the screening tool, who else touches it, what we will sign, and what we do not yet have. Written for the person in procurement or research IT who has to sign this off.

Reviews save privately to your account

When you import a search export, the records are parsed, de-duplicated and ranked in your browser. As soon as you import records, the review saves to your account automatically and keeps saving as you screen, so you can reopen it on any device. A saved review is private: only you and the people you invite to it can see it.

A review stays only in your browser when it is the demo review, when it is over your plan's limit (on the free plan, 20,000 records per review and 3 saved reviews), when you turn on "Keep reviews in this browser only" in Preferences, or when this browser held it from before you signed in and you have not yet chosen to save it. Beyond saving, data reaches our servers only when you invite a collaborator, upload a PDF for full-text screening, or run one of the AI features.

Where cloud data lives

Cloud-saved reviews sit in a Postgres database with row-level security enabled and a deny-by-default policy, so a row is reachable only through a query that proves the caller owns it or was invited to it. Uploaded PDFs go to a private storage bucket that is not publicly addressable. Traffic is encrypted in transit.

AI features send only the text needed for the specific operation you ran, at the moment you run it. Your corpus is not used to train models and is not retained by us for training.

Subprocessors

The third parties that can process your data, and what each one sees.

Provider	Purpose	Data involved
Supabase	Postgres database, authentication, and private file storage for cloud-saved reviews	Account details, review metadata, records in reviews saved to your account, uploaded PDFs
Vercel	Application hosting and content delivery	Request logs, IP address at the edge
Cloudflare	Network edge in front of the application: TLS, caching, and attack protection	Request logs, IP address, and the traffic passing through the edge
Anthropic	AI screening, AI extraction, AI translation, and Ask your records	Only the titles, abstracts, or full texts you send to an AI feature, at the moment you run it
Resend	Transactional email (sign-in links, invitations, notifications)	Email address and message content
Lunastric LLC (Stripe)	Card payments: subscription billing for self-serve plans, and one-time credit pack purchases. Charges may appear as LUNASTRIC LLC on your statement	Billing identifiers. Card details never reach our servers
PayPal	One-time credit pack purchases, when you choose to pay with a PayPal account	Billing identifiers. Card details never reach our servers
Google Analytics	Website usage analytics (page views and events)	Page addresses with tokens removed, device and browser details, approximate location. In the EEA, the UK and Switzerland, only after you accept cookies
Microsoft Clarity	Session recordings and heatmaps of how pages are used	Clicks, scrolling and page interactions, device and browser details. In the EEA, the UK and Switzerland, only after you accept cookies
Meta Pixel	Advertising measurement	Page views and conversion events, device and browser details. In the EEA, the UK and Switzerland, held until you accept cookies

Your data, your call

Export any review to CSV, RIS, or Excel at any time, on any plan, including the free one. There is no export paywall and no lock-in.
Delete a cloud review and its records and uploaded PDFs are removed. Ask us to delete your account and we remove the account and everything attached to it.
Cancelling a paid plan does not delete your data or your exports.

What we will provide and sign

A formal written quote, on request, for any plan.
Purchase orders accepted; we invoice in US dollars by bank transfer.
W-9 or the equivalent tax form for your jurisdiction.
Completed security questionnaires.
A data processing agreement. A business associate agreement can be discussed on the Enterprise plan (see below for what it depends on).
Vendor registration in your procurement portal, where you require it.

What we do not have yet

We would rather you learn this here than three weeks into a procurement review.

No SOC 2 report and no ISO 27001 certificate. Neither audit has been completed. Some competitors hold these; if your institution requires one as a condition of purchase, we are not a fit today and we will tell you so rather than run you through a process that cannot close.
No HIPAA certification. HIPAA has no certifying body, so nobody can hold one, but the meaningful question is whether we will sign a business associate agreement and operate to it. We can discuss one on the Enterprise plan, but signing it depends on matching agreements with our own infrastructure providers that are not yet in place, so please do not upload protected health information until we have confirmed it in writing. Screening bibliographic records does not normally involve protected health information in the first place.
No formal VPAT. The tool ships keyboard navigation, adjustable font size, and a colour-blind-safe palette, but no accessibility conformance report has been published.

Something here that procurement needs answered?

Send the questionnaire and we will complete it, or tell us the blocker and we will tell you straight whether we clear it.

Talk to our team