Privacy and Security
This local version stores projects, uploaded documents, extracted text, findings, and analysis history in a SQLite database on this computer under .permitai_data/permitai.db.
PermitAI does not store credit card numbers, CVV codes, or bank data. If payment is configured, the user is redirected to a hosted checkout provider.
Basic protections include password login, signed session cookies, CSRF token checks, upload size limits, filename sanitization, duplicate detection by SHA-256 hash, and browser security headers.
For production deployment, use HTTPS, strong secrets, provider-hosted payments, access controls per company/team, backups, and annual PCI/vendor compliance review.