Skip to content
Patenty.ai

Security policy

Last Modified: July 20, 2026 | Effective Date: July 20, 2026

1. Security Policy Overview

Patenty applies HTTPS connections and project-level access controls to protect user data and personal information.

This security policy outlines our security principles and implementation measures, presenting security standards that all users and employees must follow.

2. Security Goals

Our security system aims to achieve the following core objectives:

  • Confidentiality: Protecting information from unauthorized access
  • Integrity: Ensuring data accuracy and completeness
  • Availability: Providing continuous and stable service
  • Accountability: Tracking and auditing capabilities for all activities

3. Data Security

Data protection

  • Data in transit: HTTPS connections with an HSTS policy in production
  • Stored data protection: Data access checks based on project ownership and collaborator roles and permissions
  • API key management: Secure key management through environment variables
  • Storage and processing locations: The database connection is configured for Seoul; AI inference uses global endpoints and may be processed elsewhere.

Data management

  • Principle of data minimization
  • Users can delete stored projects; legally required records are retained separately
  • Reviewing backup settings and recovery procedures is an operational goal
  • Reviewing and updating access permissions is an operational goal

4. System Security

Cloud infrastructure

  • Application hosting: Application hosting with HTTPS connections
  • Database: Project access checks and database access policies
  • Web firewall: Review controls to reduce malicious traffic and SQL injection risks
  • Security patch review: Review security patch requirements

Web application protection goals

  • CSRF token-based protection against cross-site request forgery
  • Input data validation and escaping to prevent XSS
  • Parameterized queries to prevent SQL injection
  • Security headers to prevent clickjacking and content injection

5. Access Control

Authentication

  • Authentication platform: OAuth 2.0-based authentication system
  • Session management: Signed session tokens for secure sessions
  • Password policy: Strong password requirements and hashing
  • Account security: Review protections against unusual login attempts

Permission management

  • Role-based access control (RBAC)
  • Permission granting based on principle of least privilege
  • Granular access permissions per matter
  • Reviewing and updating permissions is an operational goal

6. AI Service Security

Third-party AI services

  • AI infrastructure: Pro Secure and Enterprise use Vertex AI; eligible tasks on general plans may use OpenRouter.
  • OCR service: Specialized OCR service processed server-side only (sends only the minimum data required for AI processing)
  • API key security: Key management accessible only from server-side
  • Data minimization: Transmitting only minimal data required for AI processing

AI security operational goals

  • Pre-validation of data sent to AI models
  • Review the risk of sensitive information in AI responses
  • Security logging of AI service usage
  • Security impact assessment when updating AI models

7. Security Monitoring

Monitoring operational goals

  • Real-time system status monitoring
  • Detection of abnormal access patterns
  • Service availability monitoring
  • Performance anomaly alerts

Logging and audit operational goals

  • Log events within the scope needed for security and operations
  • System events and error logs
  • Tracking data access and modification history
  • Regular log analysis and reporting

8. Security Incident Response

Response system

  • Personnel: Identify response owners and escalation paths when an incident occurs
  • Response procedures: Establish and review response procedures appropriate to the incident
  • Cloud support: Coordination with hosting and database subprocessors’ support teams
  • External cooperation: Cooperation with security specialists when necessary

Incident notification

  • Immediate internal team notification system
  • For incidents affecting customer data, initial customer notification within 24 hours of awareness, with staged detail updates as confirmed
  • Reporting to relevant authorities (when necessary)
  • Post-incident improvement plan development and implementation

9. Security Awareness and Training Plans

  • Regular security training for employees
  • Sharing latest security threat information
  • Security policy awareness and compliance checks
  • Social engineering attack response training
  • Security incident simulation and response training

10. Third-Party Service Security

Patenty.AI uses the following subprocessors to provide the service. See /privacy/subprocessors for the current full list and processing terms:

  • Application hosting: Application hosting with HTTPS connections
  • Database: Database connection configured for Seoul and project-level access controls
  • Google cloud AI: Vertex AI is covered by the Cloud Data Processing Addendum (CDPA) included in Google Cloud standard terms. Google does not use customer data to train or fine-tune AI models without the customer’s prior permission or instruction.
  • Document extraction: Document OCR processing. See the subprocessor list for processing terms.
  • Economy AI routing: May process eligible AI tasks on general plans. OpenRouter requests are routed only to providers with policies that deny data collection and provide zero data retention.

11. Legal Compliance

We review and address legal requirements applicable to the service:

  • Domestic laws: Personal Information Protection Act, Information and Communications Network Act, Cloud Computing Act
  • Cloud security: Cloud Computing Development and User Protection Act
  • Basic security: Review information security requirements applicable to the service
  • International standards: Assess the applicability of GDPR, CCPA and other overseas rules and the measures required in each case

12. Security Policy Management

We review and update this policy as laws, service configuration and data processing change.

When policies change, users are notified in advance, and explicit consent is obtained for significant changes.

For inquiries about security policies or to report security incidents, please contact:

Security officer: Sangmin Lee (CEO)

Email: contact@patenty.ai

Address: Suite 1218, 12F, Hybro Building, 503 Teheran-ro, Gangnam-gu, Seoul, South Korea