> ## Documentation Index
> Fetch the complete documentation index at: https://help.draftable.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Document Privacy and Security with the Draftable API
> How the Draftable API protects your documents: hosting, data lifecycle control, retention and deletion, encryption in transit and at rest, and our compliance certifications.
Draftable takes the privacy and security of your documents seriously. This page summarises how your data is handled when you use the cloud-hosted **Draftable API**, the controls you have over the lifecycle of that data, and the certifications that underpin our security programme.
This page covers the **cloud-hosted Draftable API** (`api.draftable.com`). If you run the **Self-Hosted API (APISH)** in your own environment, your documents never leave your infrastructure and you control retention, storage, and deletion directly. See the Draftable APISH documentation for details.
## Where your documents are hosted
Customer data submitted to the Draftable API is stored in Amazon Web Services (AWS) infrastructure that is owned and operated by Draftable, using **Amazon S3** for document storage and **Amazon RDS** for application data.
Access to customer data is controlled at the application layer. While Draftable owns the underlying infrastructure, our staff do not have direct access to the content of your documents in the course of normal operations.
If your organisation has specific data residency or regional hosting requirements, contact us at [support@draftable.com](mailto:support@draftable.com) and we can advise on the options available.
## You control the lifecycle of your data
Documents and comparisons you submit to the Draftable API are retained until you remove them. You decide how long your data persists, using the lifecycle controls built into the API and client libraries:
* **Comparison expiry (recommended).** Set an `expires` value when you create a comparison and the API automatically deletes the comparison and all associated documents once that time passes.
* **Manual deletion.** Delete any comparison and its documents on demand with a single API call or SDK method.
* **URL expiry.** Control how long a signed viewer link stays valid. This affects link access only and does **not** delete documents or free storage.
For step-by-step examples in C#, Python, and Node.js, see [How to delete comparisons in Draftable API](/hc/en-us/articles/How-to-delete-comparisons-in-Draftable-API).
The most reliable way to keep only the data you need is to set an `expires` value on every comparison you create. This guarantees automatic cleanup without any manual intervention.
If you are not able to make API or SDK calls yourself, you can also ask our support team to delete a specific comparison on your behalf. Just supply the comparison identifier or URL.
## Retention and deletion
By default, data you upload through the authenticated Draftable API is retained until you choose to delete it or until an expiry you set is reached. These durations are an upper bound: where your data is no longer needed to deliver the service, it may be removed earlier.
When a deletion is processed (whether by expiry, by an API call, or on request), the data is made **immediately inaccessible**. A copy may persist briefly in encrypted backups, which age out automatically. The maximum period for which data may remain in backups after a deletion request is **30 days**.
If your organisation requires a custom retention schedule, this can be arranged by written agreement. Contact [support@draftable.com](mailto:support@draftable.com) to discuss your requirements.
## Encryption
**In transit.** All data transmitted between your systems and the Draftable API travels over the public internet encrypted with **TLS 1.2 or TLS 1.3**. Older, insecure protocol versions (TLS 1.1 and below, and all versions of SSL) are not permitted.
**At rest.** Stored customer data is encrypted using the **Advanced Encryption Standard (AES) with 256-bit keys**. Both document storage and the application database are encrypted, with encryption keys managed by AWS under controlled access and regular rotation.
## Certifications and compliance
Draftable is part of Affinda Holdings Pty Ltd, and our security and compliance programme covers the Draftable brand. Independently verified certifications and assurances include:
* **ISO/IEC 27001:2022** certified information security management system.
* **SOC 2 Type II** attestation covering the Security trust services criteria.
* **Independent, third-party penetration testing** of our web applications, with remediation and retesting.
* Ongoing security controls including proactive monitoring, multi-factor authentication, and access logging for customer data.
You can view our current certificates and security posture, including the latest ISO/IEC 27001 certificate, in our [Trust Center](https://trust.affinda.com/).
For data protection and privacy obligations (including GDPR), our practices are governed by our [Privacy Policy](https://www.draftable.com/privacy). Where a customer requires additional contractual assurance, a confidentiality agreement or non-disclosure agreement (NDA) can be arranged.
## Where to find our policies and reports
The **Draftable (Affinda Group) Trust Center** is the single source of truth for our current certifications, security posture, and policy documents:
* **Trust Center:** [https://trust.affinda.com/](https://trust.affinda.com/)
* **Privacy Policy:** [https://www.draftable.com/privacy](https://www.draftable.com/privacy)
Many documents in the Trust Center are marked as restricted. The site will prompt you to request access with your work email. For a walkthrough, see [Accessing Draftable's compliance and security documentation](/hc/en-us/articles/49898032588569-Accessing-Draftable-s-Compliance-Security-Documentation).
## Need help?
If you have questions about how your documents are handled, or you need documentation for a security review, contact our team at [support@draftable.com](mailto:support@draftable.com) and we will be glad to help.