Security & data

What we do with your data, what we don't, and the controls you have.

The short version

• RigorDesk does not use your prompts or debate outputs to train any model.
• RigorDesk encrypts data in transit with TLS 1.2+ everywhere and encrypts data at rest in Postgres and Supabase storage.
• RigorDesk hashes API keys with SHA-256 at rest. RigorDesk shows the plaintext once on creation and never stores it.
• Public share URLs are unguessable, with 16 bytes of hex or 32 characters.
• Documents you upload stay scoped to your account. RigorDesk deletes them when you delete the debate.

What we store

For every account:

• Email from your auth provider
• Subscription state, including tier, renewal date, and Paddle customer id
• API key hashes using SHA-256, prefixes made of the first 8 chars of the plaintext, names, and last-used timestamp

For every debate:

• Prompt, your input
• Each model's response with full text, including reasoning if enabled
• Consensus scores for each round and each pair
• Cost and token breakdown for each turn
• The chairman's verdict
• Document references for the documents you uploaded, with their text chunks and embeddings
• Public share slug if you toggled share on
• The verdict's citations with filename, page, section, and snippet

For every public share:

• Anyone with the share URL can read the debate id, verdict, model scores, and per-round transcripts. RigorDesk shows the prompt by default. You can hide it in the share settings.

What we don't do

• We don't use your content to train our own models. Selected third-party model providers process your content for inference. Their logging, abuse-monitoring, training opt-out, and retention terms vary by provider and route.
• We don't sell your data. The platform is a paid product. We make money from subscriptions, not data.
• We don't share your debates with other users. Public shares are explicitly opt-in. Only the owner and any API key that owns them can see private debates.

Encryption

Authentication

The web UI uses Supabase Auth for email and OAuth via Google. Sessions use JWTs with 1-hour access tokens and 30-day refresh tokens.

The v1 API uses bearer tokens such as Authorization: Bearer dbt_…. RigorDesk generates tokens client-side and hashes them with SHA-256 at rest. It shows the plaintext only on creation. Revoke a token in Settings → API Keys. Revocation is immediate.

Access control

RigorDesk scopes your debates and assemblies to your account. Other users cannot:

• Read your private assemblies
• Read your private debates
• Call the API on your behalf
• See your usage or cost data
• Revoke or modify your API keys

All API keys can read public assemblies, as the read endpoint returns them, but only the owner can modify or delete them. Anyone with the share URL can read public debates.

Rate limits and quotas

There are no per-API-key rate limits beyond your monthly budget. RigorDesk reserves a 429 response for future use. Upstream model-provider rate limits bound throughput.

If you're planning a system that runs hundreds of debates per minute, contact us for a dedicated rate plan.

Logs and observability

RigorDesk retains server logs for 30 days for debugging, then deletes them. Logs include:

• HTTP request metadata with method, path, status, latency, and API key prefix
• Background job events, such as debate starts, model calls, round completions, and chairman calls
• Error stack traces for failed jobs

Logs do not include:

• The contents of prompts or responses
• The contents of documents you uploaded
• API key plaintext

Webhook security

Debate webhooks require a caller-supplied secret of at least 32 characters. Every delivery is signed with HMAC-SHA256 over <unix_timestamp>.<raw_request_body> and includes X-RigorDesk-Signature: v1=<hex_digest> plus X-RigorDesk-Timestamp. Verify the signature against the raw body with a constant-time comparison and reject stale timestamps. The secret is never returned by the API or included in the delivery payload.

Data deletion

When you delete a debate, the following are removed immediately:

• The session row
• All rounds and turns
• All events
• All comments
• The public share URL (if any) becomes inaccessible
• The embedded chunks (RAG index) for any uploaded documents
• The uploaded document files (PDF, DOCX, etc.)

When you delete your account, everything above is removed plus:

• Your profile
• All assemblies (private; public assemblies are kept but unlinked from your account)
• All API keys
• Your subscription (cancelled; remaining cap is forfeited per the refund policy)

Aggregated, non-identifying data (e.g. "the platform ran 10k debates this month") may be retained for reporting. No prompt or response content is retained after deletion.

Compliance

The platform is built on Supabase (data residency: US-West, AWS us-west-2) and Vercel (edge network, US-East primary). The payment processor is Paddle, which handles VAT collection in applicable jurisdictions.

RigorDesk has not completed an independent security audit and does not currently claim SOC 2 or HIPAA compliance. Do not submit regulated or confidential material unless your organization has separately reviewed and approved the service and the selected model providers. Contact us to discuss GDPR data-processing terms or other contractual requirements.

Reporting a vulnerability

If you find a security issue, email security@tellodb.com. We respond within 24 hours. We run a responsible disclosure program and credit researchers in our security acknowledgements.

Please don't disclose vulnerabilities publicly until we've had a chance to fix them.