Security
What is true today, and what is still in progress.
Immigration files hold passports, pay records, medical results and family histories. This page lists the controls Peach actually runs, with the caveats attached, and the certifications we have not yet earned.
Per-firm isolation in the database engine
Every firm-scoped table carries PostgreSQL row-level security with forced policies and explicit write checks. The application role cannot bypass it. If the firm context is missing, queries return nothing rather than everything. Applicant tokens are scoped to a single case at the same layer.
Retrieval and embeddings on our own servers
Document search runs on a self-hosted vector store whose records carry both firm and notebook identifiers. Embeddings are computed locally. No document text is sent to an embedding vendor.
Model calls under zero-data-retention
Drafting and extraction call Anthropic models under no-training terms with organisation-level zero-data-retention in effect since 31 August 2026. Personal identifiers are masked to their last four characters before entering drafting context.
Append-only audit log
Database triggers block updates and deletes on the audit table for every role, including administrators. Firm admins see before-and-after diffs, AI activity and AI cost per case and per user. Coverage is not yet complete: some case-field edits, deletions and reads are not logged, and we say so in the product.
Sessions and credentials
Access tokens live 15 minutes; refresh tokens rotate, are bound to a 7-day absolute limit and are revoked on reuse. Optional two-factor authentication with TOTP and backup codes is available to every user. Applicant PINs are bcrypt-hashed with constant-time comparison and per-case lockout; the staff reveal copy is AES-256-GCM encrypted with a key held outside the database.
Files at rest and in transit
Documents live in Cloudflare R2 with server-side encryption at rest. Downloads use presigned URLs that expire in five minutes. Uploads are byte-sniffed for type and capped at 50 MB.
Human gates on legally material actions
Peach never submits to USCIS or DOL. Drafts cannot be exported until a lawyer verifies every citation and resolves every placeholder. Client email is sent only by a person, only to recipients the firm's contact policy allows, and every send is written to an append-only communications ledger on the case.
US hosting, US subprocessors
Servers are in the United States. Subprocessors are Anthropic (model inference), Cloudflare (file storage), Hetzner (hosting), Resend (email) and Twilio (SMS). Firms receive 30 days' notice before a subprocessor changes.
Not yet
Certifications and controls in progress.
We would rather list these than imply them.
- SOC 2
- Readiness work is underway. No report has been issued and we do not display a badge until one is.
- Backup encryption
- Backup procedures are documented with hourly snapshots and an offline key. A September 2026 review found gaps in how some backup jobs apply encryption and retention; we will state recovery objectives here once they are closed and tested.
- Host disk encryption
- Full-disk encryption on the hosting layer is planned and not yet enabled. Application data is protected by the controls above in the meantime.
- Independent penetration test
- An independent security audit has been completed and its findings remediated. A formal penetration test has not yet been commissioned.
Your data, your controls
Retention, export and erasure.
Retention policy
A written data-retention policy governs cases, files, sessions and audit records. Sessions and impersonation tokens are swept on schedule by a background worker.
Export
Firm administrators can request a structured export of their firm's data. Case files download as a ZIP or as a Petition Bundle at any time.
Erasure
Controller requests run as a dry run first, across the database, file store and vector index, and complete only after a typed confirmation. A data processing addendum is available on request.
Security questions, disclosure reports or DPA requests: [email protected]. This page was last reviewed on 10 September 2026.
Ask us the hard questions.
Bring your security questionnaire to the demo. We will answer it against the running system, not a slide.