What actually protects your documents.
You're uploading trade licenses, VAT certificates, and bank letters. This page is written for whoever on your team has to answer for that — a security questionnaire, a procurement review, or your own due diligence before a pilot.
Where your data goes, and when it stops existing.
Your documents are sent to Google's Gemini API (or, on request, Google Cloud Vertex AI with a signed DPA and regional residency) for AI-assisted extraction, stored encrypted in Cloudflare R2 and Supabase Postgres, and automatically and permanently deleted 90 days after your review completes — sooner if you delete it yourself.
| Step | Where | Why |
|---|---|---|
| Upload | Cloudflare R2, encrypted at rest (AES-256), TLS 1.3 in transit | Object storage for your files and generated exports |
| AI extraction | Google Gemini API (default) or Google Cloud Vertex AI (on request) | Classification and field extraction from your documents |
| Extracted data | Supabase Postgres, Mumbai (ap-south-1) region | Findings, extracted fields, your reviewers' decisions |
| Resend | Expiry alerts, invites, approval notices — only if you opt in | |
| Malware scan | ClamAV (self-hosted) when configured for the deployment | Every upload is scanned before processing |
| Payment | Polar | Card data never touches our servers — Polar is the system of record |
The controls, plainly.
Encryption
Files are encrypted at rest (AES-256 in Cloudflare R2) and in transit (TLS 1.3).
File screening
Every upload is checked against its declared file type's real signature, not just its extension, and known malware test signatures are rejected before processing. When a ClamAV scanning engine is configured for the deployment, every file is additionally streamed to it for a full antivirus scan — production fails closed (rejects the upload) if that scanner is unreachable or not configured at all.
Tenant isolation
Every database query is scoped to a tenant ID resolved and verified from your authenticated session before it reaches application code — a request can never read or write another organization's data by supplying its own tenant identifier.
Hard deletion
Deleting a review removes it from storage and the database — not a soft delete — and produces a cryptographic deletion certificate as proof.
Retention
Review data (files, extracted metadata, findings, reviewer decisions) is automatically and permanently deleted 90 days after that review completes, or immediately on request. An opt-in, off-by-default accuracy-benchmarking track lets you allow us to retain document copies to measure extraction accuracy — never used to train AI models, revocable at any time with real deletion on revocation.
Authentication
Sign-in and session management run through Clerk. We never receive or store your password.
Human-in-the-loop, always
Every AI-assisted finding is produced for review, not automated action. A qualified representative of your organization reviews, approves, or overrides each finding before it informs any decision. SoulMen never alters, generates, or submits your documents on your behalf.
The two AI extraction modes, and why it matters. By default, document text/images go to the public Gemini API — no dedicated Google Cloud DPA, no data-residency guarantee. For clients who need one, extraction can run through Google Cloud Vertex AI instead: same model, same accuracy, but under Google Cloud's own DPA with regional residency. Ask before onboarding if this is a requirement for your procurement process.
Stated plainly, not buried in a footer.
SoulMen is not a registered company. It is operated jointly by Tanmay Patil and Parth Salunkhe, based in India, offering the Service to business customers in the United Arab Emirates. This is a contractual arrangement, not corporate limited-liability status — see the Terms of Service, Limitation of Liability and Governing Law sections, for exactly what that means for you.
Need a signable DPA, or have a security question?
Email [email protected] for security-specific questions, or [email protected] for anything else. Full sub-processor list and data-handling detail: Privacy Policy. Signable Data Processing Addendum: /dpa.