Skip to main content
Draftable takes the privacy and security of your documents seriously. This page summarises how your data is handled when you use the cloud-hosted Draftable API, the controls you have over the lifecycle of that data, and the certifications that underpin our security programme.
This page covers the cloud-hosted Draftable API (api.draftable.com). If you run the Self-Hosted API (APISH) in your own environment, your documents never leave your infrastructure and you control retention, storage, and deletion directly. See the Draftable APISH documentation for details.

​
Where your documents are hosted

Customer data submitted to the Draftable API is stored in Amazon Web Services (AWS) infrastructure that is owned and operated by Draftable, using Amazon S3 for document storage and Amazon RDS for application data. Access to customer data is controlled at the application layer. Access is restricted to authorised personnel on a least-privilege basis, protected by multi-factor authentication, and logged.
Accounts created through draftable.com are hosted in our US data centre. We also operate an EU data centre, and can provision your account there on request. Other regions are possible where there is enough customer commitment to support the deployment. Contact support@draftable.com to discuss your data residency requirements.

​
You control the lifecycle of your data

Documents and comparisons you submit to the Draftable API are retained until you remove them. You decide how long your data persists, using the lifecycle controls built into the API and client libraries:
  • Comparison expiry (recommended). Set an expires value when you create a comparison and the API automatically deletes the comparison and all associated documents once that time passes.
  • Manual deletion. Delete any comparison and its documents on demand with a single API call or SDK method.
  • URL expiry. Control how long a signed viewer link stays valid. This affects link access only and does not delete documents or free storage.
For step-by-step examples in C#, Python, and Node.js, see How to delete comparisons in Draftable API.
The most reliable way to keep only the data you need is to set an expires value on every comparison you create. This guarantees automatic cleanup without any manual intervention.
If you are not able to make API or SDK calls yourself, you can also ask our support team to delete a specific comparison on your behalf. Just supply the comparison identifier or URL.

​
Retention and deletion

By default, data you upload through the authenticated Draftable API is retained indefinitely unless you act on it, either by setting an expiry or by deleting it. There is no automatic clean-up that happens on your behalf, which is why we recommend setting an expires value on every comparison. When a deletion is processed (whether by expiry, by an API call, or on request), the data is made immediately inaccessible. A copy may persist briefly in encrypted backups, which age out automatically. The maximum period for which data may remain in backups after a deletion request is 30 days. Retention is governed by these service-wide controls rather than by per-customer arrangements. If you need data removed sooner, use comparison expiry or delete on demand, both described above.

​
Encryption

In transit. All data transmitted between your systems and the Draftable API travels over the public internet encrypted with TLS 1.2 or TLS 1.3. Older, insecure protocol versions (TLS 1.1 and below, and all versions of SSL) are not permitted. At rest. Stored customer data is encrypted using the Advanced Encryption Standard (AES) with 256-bit keys. Both document storage and the application database are encrypted, with encryption keys managed by AWS under controlled access and regular rotation.

​
Certifications and compliance

Draftable is part of Affinda Holdings Pty Ltd, and our security and compliance programme covers the Draftable brand. Independently verified certifications and assurances include:
  • ISO/IEC 27001:2022 certified information security management system.
  • SOC 2 Type II attestation covering the Security trust services criteria.
  • Independent, third-party penetration testing of our web application and API.
  • Ongoing security controls including proactive monitoring, multi-factor authentication, and access logging for customer data.
You can view our current certificates and security posture, including the latest ISO/IEC 27001 certificate, in our Trust Center. For data protection and privacy obligations (including GDPR), our practices are governed by our Privacy Policy. Where a customer requires additional contractual assurance, a confidentiality agreement or non-disclosure agreement (NDA) can be arranged.

​
Where to find our policies and reports

The Draftable (Affinda Group) Trust Center is the single source of truth for our current certifications, security posture, and policy documents: Many documents in the Trust Center are marked as restricted. The site will prompt you to request access with your work email. For a walkthrough, see Accessing Draftable’s compliance and security documentation.

​
Need help?

If you have questions about how your documents are handled, or you need documentation for a security review, contact our team at support@draftable.com and we will be glad to help.