Security and data handling

Uploaded contracts go into a private file store on Supabase, in its Sydney region (AWS ap-southeast-2). Scan records, such as your email address, the file name and the finished report, sit in a Supabase database in the same Sydney region.

• The storage bucket is private. It accepts PDF files only, up to 50 MB.
• Your browser uploads the file straight into that bucket using a one-time signed upload link that our server issues for that one file. No public web address exists for any contract, and the code never creates one.
• After upload, the file can only be read by our server, using a private key that never leaves the server.

• Run in Sydney. Our application server (Vercel, Sydney region) fetches the file from the Sydney bucket and extracts the text.
• Analysed in the United States. The text goes to Anthropic's Claude API, which processes it in the United States under its commercial terms (linked below).
• One copy. The Sydney bucket is the only copy of the file we keep.
• Email. Your report (never the contract file) is emailed to you through Resend, a US email delivery service.

• Server-only database access. Every read and write goes through our own server, using a key held only on the server. Your browser has no database credentials and makes no database calls.
• Row level security is on for every table, with no access rules for the public or for signed-in users. Anyone without the server key gets nothing back.
• Your report opens with a private signed link. The link carries a random-looking code that can't be guessed from the scan number. Report pages are hidden from search engines.
• Your contract is never shown to anyone else. Published benchmarks (the Australian Subcontract Index) are aggregate figures across many contracts, and never name a builder, head contractor or any other party.

• The contract file: deleted automatically 12 months after the scan. A scheduled job runs every day, finds files past their date and deletes them. The written report is cleared at the same time. An upload whose analysis never started, or stalled partway, is deleted after 24 hours.
• Scan records: after 24 months, your email address and the file name are replaced with a one-way code that can't be reversed, and your IP address and browser details are removed.
• Extracted terms: we keep structured figures read from the contract, such as payment days, retention, liquidated damages and notice periods, to build aggregate benchmarks. They are linked to you only through the scan record, which is de-identified at 24 months. As our Privacy Policy explains, this includes the name of the head contractor in the contract. That name is never published.
• Delete on request: email mat@theconstructioncontracts.co and your contract files, extracted data and scan records are deleted within 7 days. No questions asked.

The analysis is done by Anthropic's Claude models through Anthropic's commercial API, not a consumer chat app.

• Anthropic's Commercial Terms of Service state that Anthropic may not train models on customer content from its services.
• Anthropic's privacy centre says that by default it does not use inputs or outputs from its commercial products, including the API, to train its models.
• We don't train AI models either. Your contract is used to produce your report and, as the Privacy Policy explains, to improve the tool's accuracy and build de-identified aggregate benchmarks.

How our AI use lines up with the Australian Government's voluntary AI guidance, practice by practice: How we use AI responsibly.

Each report is checked against the Security of Payment Act for the contract's state or territory. The statute details the scanner works from are kept in one registry, which is reviewed when legislation changes (for example, Victoria's reforms that took effect on 15 April 2026). Last review, by state:

• Not legal advice. The report is general commercial information. See the Disclaimer.
• No certifications. We don't hold ISO 27001, SOC 2 or any other security certification, and we don't claim to. Some of the providers we use publish their own (Supabase, for example, states it is SOC 2 Type 2 compliant), but those are theirs, not ours.