Security & data handling
How Capley will handle your deal documents.
Capley is pre-launch. This page describes how Capley is designed to handle documents at launch. We’ll update it as that changes, and date each update.
Pre-launchLast updated: November 9, 2026
Commitments
What will happen to your documents.
- Where it runs
- Documents will be stored and analyzed on AWS in US regions. Analysis results will be stored with our database provider in the US. Documents and analysis will stay in the United States. Website and app traffic passes through our network provider’s global edge but isn’t stored there. Website form requests are stored in that provider’s database.
- How analysis runs
- Analysis will run on Claude through Amazon Bedrock, with zero data retention. The model provider will not keep your documents or the analysis.
- Model training
- Your documents will never be used to train models, ours or anyone else’s.
- Retention and deletion
- Documents will be deleted 90 days after a deal is closed or killed, or sooner if you delete them. If an open deal has no activity for 180 days, we’ll remind your workspace admin, and then the 90-day clock starts. Every deletion produces a receipt.
- Staff access
- During early access, our team will have no access to your documents. After early access, a document will be opened only to fix a support or security issue, only with your workspace admin’s approval, and every access will be logged.
Subprocessors
Who will process data for us.
Documents and analysis will stay in the United States. Website and app traffic passes through our network provider’s global edge but isn’t stored there. Website form requests are stored in that provider’s database.
| Provider | Role | Deal data |
|---|---|---|
| Amazon Web Services | Hosting, document storage, encryption keys, AI processing (Claude on Amazon Bedrock) | Documents: stored and processed in the US, with zero data retention |
| Database provider (US) | Accounts, deal records, analysis results | Findings and extracted terms, including short quotations from documents; not original documents |
| Sign-in provider | User accounts | No |
| Payments provider | Billing | No |
| Network provider | Website delivery and encryption in transit | In transit only; not stored |
| Email provider | Notifications | No deal content |
| Analytics provider (None) | Site analytics, only with consent | No |
Amazon Web ServicesHosting, document storage, encryption keys, AI processing (Claude on Amazon Bedrock)Deal data: Documents: stored and processed in the US, with zero data retention
Database provider (US)Accounts, deal records, analysis resultsDeal data: Findings and extracted terms, including short quotations from documents; not original documents
Sign-in providerUser accountsDeal data: No
Payments providerBillingDeal data: No
Network providerWebsite delivery and encryption in transitDeal data: In transit only; not stored
Email providerNotificationsDeal data: No deal content
Analytics provider (None)Site analytics, only with consentDeal data: No
We’ll share the full list of named providers on request and in our data processing agreement, and we’ll give notice before adding one.
Request the subprocessor listHave a security questionnaire?
Send it to our team. We’ll answer it and walk your counsel through how documents move through Capley.