> ## Documentation Index
> Fetch the complete documentation index at: https://help.draftable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Document Privacy and Security with the Draftable API

> How the Draftable API protects your documents: hosting, data lifecycle control, retention and deletion, encryption in transit and at rest, and our compliance certifications.

Draftable takes the privacy and security of your documents seriously. This page summarises how your data is handled when you use the cloud-hosted **Draftable API**, the controls you have over the lifecycle of that data, and the certifications that underpin our security programme.

<Note>
  This page covers the **cloud-hosted Draftable API** (`api.draftable.com`). If you run the **Self-Hosted API (APISH)** in your own environment, your documents never leave your infrastructure and you control retention, storage, and deletion directly. See the Draftable APISH documentation for details.
</Note>

## Where your documents are hosted

Customer data submitted to the Draftable API is stored in Amazon Web Services (AWS) infrastructure that is owned and operated by Draftable, using **Amazon S3** for document storage and **Amazon RDS** for application data.

Access to customer data is controlled at the application layer. Access is restricted to authorised personnel on a least-privilege basis, protected by multi-factor authentication, and logged.

<Note>
  Accounts created through draftable.com are hosted in our US data centre. We also operate an **EU data centre**, and can provision your account there on request. Other regions are possible where there is enough customer commitment to support the deployment. Contact [support@draftable.com](mailto:support@draftable.com) to discuss your data residency requirements.
</Note>

## You control the lifecycle of your data

Documents and comparisons you submit to the Draftable API are retained until you remove them. You decide how long your data persists, using the lifecycle controls built into the API and client libraries:

* **Comparison expiry (recommended).** Set an `expires` value when you create a comparison and the API automatically deletes the comparison and all associated documents once that time passes.
* **Manual deletion.** Delete any comparison and its documents on demand with a single API call or SDK method.
* **URL expiry.** Control how long a signed viewer link stays valid. This affects link access only and does **not** delete documents or free storage.

For step-by-step examples in C#, Python, and Node.js, see [How to delete comparisons in Draftable API](/hc/en-us/articles/How-to-delete-comparisons-in-Draftable-API).

<Tip>
  The most reliable way to keep only the data you need is to set an `expires` value on every comparison you create. This guarantees automatic cleanup without any manual intervention.
</Tip>

If you are not able to make API or SDK calls yourself, you can also ask our support team to delete a specific comparison on your behalf. Just supply the comparison identifier or URL.

## Retention and deletion

By default, data you upload through the authenticated Draftable API is **retained indefinitely unless you act on it**, either by setting an expiry or by deleting it. There is no automatic clean-up that happens on your behalf, which is why we recommend setting an `expires` value on every comparison.

When a deletion is processed (whether by expiry, by an API call, or on request), the data is made **immediately inaccessible**. A copy may persist briefly in encrypted backups, which age out automatically. The maximum period for which data may remain in backups after a deletion request is **30 days**.

Retention is governed by these service-wide controls rather than by per-customer arrangements. If you need data removed sooner, use comparison expiry or delete on demand, both described above.

## Encryption

**In transit.** All data transmitted between your systems and the Draftable API travels over the public internet encrypted with **TLS 1.2 or TLS 1.3**. Older, insecure protocol versions (TLS 1.1 and below, and all versions of SSL) are not permitted.

**At rest.** Stored customer data is encrypted using the **Advanced Encryption Standard (AES) with 256-bit keys**. Both document storage and the application database are encrypted, with encryption keys managed by AWS under controlled access and regular rotation.

## Certifications and compliance

Draftable is part of Affinda Holdings Pty Ltd, and our security and compliance programme covers the Draftable brand. Independently verified certifications and assurances include:

* **ISO/IEC 27001:2022** certified information security management system.
* **SOC 2 Type II** attestation covering the Security trust services criteria.
* **Independent, third-party penetration testing** of our web application and API.
* Ongoing security controls including proactive monitoring, multi-factor authentication, and access logging for customer data.

You can view our current certificates and security posture, including the latest ISO/IEC 27001 certificate, in our [Trust Center](https://trust.affinda.com/).

For data protection and privacy obligations (including GDPR), our practices are governed by our [Privacy Policy](https://www.draftable.com/privacy). Where a customer requires additional contractual assurance, a confidentiality agreement or non-disclosure agreement (NDA) can be arranged.

## Where to find our policies and reports

The **Draftable (Affinda Group) Trust Center** is the single source of truth for our current certifications, security posture, and policy documents:

* **Trust Center:** [https://trust.affinda.com/](https://trust.affinda.com/)
* **Privacy Policy:** [https://www.draftable.com/privacy](https://www.draftable.com/privacy)

Many documents in the Trust Center are marked as restricted. The site will prompt you to request access with your work email. For a walkthrough, see [Accessing Draftable's compliance and security documentation](/hc/en-us/articles/49898032588569-Accessing-Draftable-s-Compliance-Security-Documentation).

## Need help?

If you have questions about how your documents are handled, or you need documentation for a security review, contact our team at [support@draftable.com](mailto:support@draftable.com) and we will be glad to help.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.