Your prices, your clients, your money. Here is exactly how they are held.
A quote carries what you charge and who you charge it to — two of the most sensitive things a contractor owns. This page describes the controls that are actually in place today, and names the ones that are not.
Standards and certifications
Where we genuinely stand. We would rather lose a deal than put a badge on this page that an auditor has not issued.
Controller and processor roles are separated in the Privacy Policy, transfers run on standard contractual clauses, and data-subject requests are handled at privacy@melodocs.ai. A data processing agreement is available on request.
We do not sell personal data and do not share it for cross-context behavioural advertising. Notice at collection, deletion, correction and access rights are all covered in the Privacy Policy.
Card details never reach our servers. Payments run through Stripe, a PCI DSS Level 1 service provider, on hosted checkout — we store the result of a payment, never the instrument.
Not held by MeloDocs yet. The infrastructure underneath us — our database, storage and hosting providers — maintains SOC 2 Type II reports. Ours is planned, and this page will carry the report when it exists.
Not held, and not currently in progress. If your procurement process requires it, tell us at the start rather than at the end — we will say so plainly rather than let it sit.
MeloDocs is not designed for protected health information and we do not sign business associate agreements. Do not put PHI in a document.
How your data is protected
The controls that apply to every document, on every plan, including the free one.
What the model sees, and what it keeps
MeloAI drafts documents from what you type. Everything below is the whole arrangement — there is no fourth thing we do quietly.
- Your own work improves your own results. Your rate book, your wording and your layout preferences stay inside your workspace and are never pooled with anyone else’s.
- De-identified, aggregated data improves the product. Counts, timings and failure patterns — stripped of anything that identifies you, your clients or your prices.
- Training on identifiable content is opt-in and off by default. It stays off unless you switch it on, and you can switch it back off — though turning it off cannot un-train a model already built.
- Our model provider does not train on your content. Prompts are processed by Anthropic under commercial API terms, which exclude the use of API inputs and outputs to train their models.
- Extracted text is data, never instruction. Text lifted from an uploaded PDF, a plan schedule or a bank file is treated as content to be read, not as commands to be followed. Every value a model returns is validated against real records before it can affect anything — an injected “approve $9,999” can at worst produce a rejected proposal.
- No model writes to your ledger. In MeloBooks, AI output lands in a proposal queue. A human decides, and the posting runs through the same deterministic path a manual entry uses.
Payments
MeloPay moves money between you and your client. We are the software in the middle, not the bank.
How we build it
- Invariants live in the database. Tenant scoping, ledger immutability, closed accounting periods and the takeoff engine’s “no quantity without a mark” rule are all enforced by Postgres, so a mistake in application code cannot break them.
- The whole codebase is typed, and the build gates on it. Type checking, linting and the test suites run before anything ships.
- Money is never a floating-point number. All amounts are integer cents, and all rounding goes through one function. Financial logic is mirrored in two independent implementations that are fuzz-tested against each other on every change.
- Measurement is never guessed. No model is asked how long or how large something is — geometry does that, and a takeoff cannot be published on an unconfirmed drawing scale. There is no override flag.
- Dependencies are kept deliberately few. The application ships with a short dependency list, which is the cheapest supply-chain control there is.
- Secrets live in the hosting environment. Keys are injected at runtime, never committed, and the service-role key is scoped to the one worker that needs it.
If a breach affects your data, we will notify you without undue delay and, where the law sets a clock — 72 hours under GDPR — inside it. You will get what we know, what we do not know yet, what we are doing, and what you need to do. We would rather send you an early notice with gaps in it than a tidy one a week later.
Who else touches your data
Four companies, each under contract, each acting on our instructions and none permitted to use your data for their own purposes.
| Sub-processor | What it does | What it sees | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Everything you store | United States |
| Vercel | Application hosting and content delivery | Requests in transit; no document storage | United States, global edge |
| Anthropic | Model processing for MeloAI | The prompt and document content you send it | United States |
| Stripe | Subscription billing and MeloPay payments | Payment details and payer contact information | United States and worldwide |
This list is kept current and changes are posted before a new sub-processor starts handling customer data. Customers under a data processing agreement can ask to be notified in advance: privacy@melodocs.ai. There is no advertising network, analytics vendor or session recorder on this list, because there is none in the product.
Not yet
The controls a security reviewer will ask about that we have not built. Listing them is cheaper for both of us than discovering them in a questionnaire.
| Control | Status | Where it stands |
|---|---|---|
| Multi-factor authentication | In progress | Sign-in today is email and password, or Google. MFA is the next authentication change we make. |
| SAML / enterprise SSO | Not yet | Not built. Google sign-in is the only identity provider supported. |
| Revoking a share link | In progress | A share link is a random token that stays valid once minted. Rotating and revoking it from the workspace is being built; until then, ask us and we will clear it. |
| Self-serve account deletion | In progress | Deletion is honoured on request at privacy@melodocs.ai within the timeframes in the Privacy Policy, but there is no button for it yet. |
| Audit log export | Not yet | Activity is recorded and visible in the product; exporting it as a file is not built. |
| Customer-managed encryption keys | Not yet | Not offered. Encryption keys are managed by our infrastructure providers. |
| Penetration test report | Not yet | No third-party penetration test has been commissioned yet. When one is, the summary letter will be available under NDA. |
Reporting a vulnerability
Email security@melodocs.ai with enough detail to reproduce it. We acknowledge within one business day, tell you what we found, and tell you when it is fixed.
Safe harbour. We will not pursue legal action, or ask anyone else to, over good-faith research that follows the rules below. If a third party brings a claim over research that followed them, we will say publicly that it was authorised.
- Use your own account and your own test data.
- Stop as soon as you have proof; do not read, alter or keep anyone else’s data.
- No denial of service, spam, social engineering or physical attempts.
- Give us a reasonable window to fix it before publishing.
Reviewing us for your company?
Ask for a data processing agreement, a completed security questionnaire, or an advance-notice commitment on sub-processors. A real person answers, and if the answer is “we do not have that”, that is what you will get.
security@melodocs.ai