Security

This is the first question people ask about any AI tool, so it goes first.

Basecase uses Anthropic’s API to read and structure your documents. Anthropic’s commercial API terms prohibit training on inputs submitted through it. We do not train models of our own on customer content, and we do not license your documents to anyone.

We do retain de-identified property and market data to power benchmarking. That is a statistical dataset, not model training, it never includes resident names, and it is described in full in our Privacy Policy.

All traffic to and from Basecase is encrypted in transit using TLS. Data at rest — the database and uploaded documents alike — is encrypted with AES-256 by our infrastructure provider.

Uploaded documents are never exposed through public URLs or pre-signed links. There is no address a browser can hit to reach a stored file, shared or guessed.

Every retrieval goes through an authenticated API endpoint that checks ownership first and streams the file server-side. This is a deliberate design choice: it means a leaked link cannot exist, because links to files do not exist.

Row-Level Security is enabled on every table holding customer data — 18 tables covering deals, files, units, financials, assumptions, properties, jobs, subscriptions, and usage. Isolation is enforced by the database, not only by application code.

On top of that, every endpoint that touches a deal or a file re-checks ownership against the authenticated user before returning anything. A request for a record you do not own returns the same response as a request for a record that does not exist.

Authentication is handled by Clerk, a SOC 2 Type II certified provider. We never see or store your password.

API requests are authorised by verifying a signed token against Clerk’s published keys, which we refresh hourly so that key rotation takes effect without operator intervention. API endpoints are rate limited.

Rent rolls routinely contain resident names — information belonging to people who never signed up for anything. We hold it for the shortest period the product allows.

Resident names are used only to display and verify the rent roll you uploaded. No calculation in our model uses one. They are removed automatically from our structured data within 90 days, they are never part of the benchmarking dataset, and they are never shared.

Deleting a file removes the original document from storage immediately and strips resident names from the extracted data. Closing your account removes your uploaded documents, your model outputs, and the link between you and any data derived from them.

What is retained after deletion is de-identified property and market data, which describes buildings rather than people or customers. The Privacy Policy sets out precisely what stays and what goes.

Basecase runs on Vercel and Railway, stores data in Supabase, authenticates with Clerk, bills through Stripe, and processes documents with Anthropic. Property addresses typed into the address field are sent to Google Maps Platform for autocomplete.

We use Sentry for error monitoring and PostHog for product analytics. Both are configured to exclude your data: Sentry is set never to capture request bodies or the local variables inside a stack frame, which is where document contents would otherwise leak, and PostHog records which features were used against an anonymous account identifier — never a name, an address, or a number from your deal.

A table of what each provider receives is in the Privacy Policy.

Basecase is an early-stage company, and a trust page that omits this section is not being straight with you.

We do not hold a SOC 2 report and are not currently engaged with an auditor. We have not commissioned an external penetration test. We do not offer a contractual uptime guarantee.

If any of these are a requirement for your firm, tell us — knowing which control gets asked for first is how we decide what to build next.

Email security@basecase.xyz. We will acknowledge within two business days. We will not pursue legal action against researchers who report in good faith, act in proportion, and give us a reasonable window to fix the issue before disclosing it.