Security

This is the first question people ask about any AI tool, so it goes first.

Basecase uses Anthropic’s API to read and structure your documents. Anthropic’s commercial API terms prohibit training on inputs submitted through it. We do not train models of our own on customer content, and we do not license your documents to anyone.

We do retain de-identified property and market data to power benchmarking. That is a statistical dataset, not model training, it never includes resident names, and it is described in full in our Privacy Policy.

All traffic to and from Basecase is encrypted in transit using TLS. Data at rest — the database and uploaded documents alike — is encrypted with AES-256 by our infrastructure provider.

Uploaded documents are never exposed through public URLs or pre-signed links. There is no address a browser can hit to reach a stored document, shared or guessed.

Every document retrieval goes through an authenticated API endpoint that checks access first and streams the file server-side. A model workbook download is the one exception: it uses a signed link that expires within minutes and is issued only after the request is authorized. Nothing else from your deals is ever served by link.

Every request is authorized in the application, against the deal’s owner or organization and your role, before anything else is read. The database is reachable only by our servers, with their own credentials, never by your browser.

Deal room endpoints answer “not found” for anything you may not see, the same answer they give for something that does not exist.

Authentication is handled by Clerk, a SOC 2 Type II certified provider. We never see or store your password. A shared deal room login’s password is generated by Basecase, shown once to the organization that created it, and never kept.

API requests are authorised by verifying a signed token against Clerk’s published keys, which we refresh hourly so that key rotation takes effect without operator intervention. API endpoints are rate limited.

A deal room lets your organization share chosen underwriting runs with an outside party. Guests sign in with an account verified by a code sent to the invited address, or with a username and password your organization issues and can revoke, and they see read-only output pages, never your source documents or inputs beyond what those pages print. You can withdraw a guest’s access at any time, and you see what each guest opened.

Rent rolls routinely contain resident names — information belonging to people who never signed up for anything. We hold it for the shortest period the product allows.

Resident names are used only to display and verify the rent roll you uploaded. No calculation in our model uses one. They are removed automatically from our structured data within 90 days, they are never part of the benchmarking dataset, and they are never shared outside your organization unless you turn that on for a deal room partner that owns or manages the building.

Deleting a file removes the original document from storage immediately and strips resident names from the extracted data. Closing your account removes your uploaded documents, your model outputs, and the link between you and any data derived from them.

What is retained after deletion is de-identified property and market data, which describes buildings rather than people or customers. The Privacy Policy sets out precisely what stays and what goes.

Basecase runs on Vercel and Railway, stores data in Supabase, authenticates with Clerk, bills through Stripe, processes documents with Anthropic, and delivers deal room invitation emails through Resend. Property addresses typed into the address field are sent to Google Maps Platform for autocomplete.

We use Sentry for error monitoring and PostHog for product analytics. Sentry is set never to capture request bodies or the local variables inside a stack frame, which is where document contents would otherwise leak. We send PostHog product events, never the contents of a deal; on deal room pages we send nothing but a page-opened event.

A table of what each provider receives is in the Privacy Policy.

Basecase is an early-stage company, and a trust page that omits this section is not being straight with you.

We do not hold a SOC 2 report and are not currently engaged with an auditor. We have not commissioned an external penetration test. We do not offer a contractual uptime guarantee.

If any of these are a requirement for your firm, tell us — knowing which control gets asked for first is how we decide what to build next.

Email security@basecase.xyz. We will acknowledge within two business days. We will not pursue legal action against researchers who report in good faith, act in proportion, and give us a reasonable window to fix the issue before disclosing it.