Trust & Security

Your invention is your edge.
We protect it like one.

Last updated: June 12, 2026

The short version: your code is encrypted in transit and at rest, locked behind a private 256-bit access key that only ever lands in your inbox, never used to train AI models, and automatically deleted 30 days after your review session opens.

256-bit
Private access key per review session, generated with a cryptographically secure RNG and delivered only to your email
AES-256
Application-level AES-256-GCM encryption of your code and session data before it ever reaches our database — on top of encrypted storage infrastructure
TLS
Every connection encrypted in transit; HTTPS enforced with HSTS — plain HTTP is never accepted
30 days
Automatic deletion of your code after the review window — enforced at the API and by a daily purge job

Your code is locked behind a private key

Every Interactive Code Review session is protected by a unique 256-bit access key generated with a cryptographically secure random number generator. The key travels in the access link we email you, a cookie, or a request header — not in a query string we log. Guessing a report number is not enough to open the session. Key comparisons are timing-safe, and our APIs rate-limit lookup attempts. We do not promise that a filing can never be exposed; we publish the controls we actually run.

Firm / counsel pilots

A cobranded firm Screen keeps Patent PreCheck as the author of a directional screen. Firm rows are scoped by org_id. Inventor emails are not captured on a firm origin and are not used for Patent PreCheck marketing. Session keys stay out of query strings. We do not claim SOC 2 or that the system cannot be hacked. Counsel review of the firm contract is still required before a paid firm SKU.

Encrypted in transit and at rest

All traffic to Patent PreCheck is encrypted with TLS, and we send HTTP Strict Transport Security headers so browsers refuse to ever connect insecurely. At rest, your code goes further than standard disk encryption: we encrypt your submitted code and review session data with AES-256-GCM at the application level, using our own keys, before it is written to the database. Even if the database itself were compromised, your code would be unreadable ciphertext. That sits on top of the AES-256 encryption our database and file storage infrastructure already applies.

Your code never trains an AI model

Scoring and coaching use commercial API tiers of our AI providers, whose terms exclude API submissions from model training. Your invention is analyzed, scored, and then handled per our retention rules — it does not become anyone’s training data, including ours.

Automatic deletion — not a promise, a process

Your paid review session stays active for 30 days. When the window closes, our APIs immediately stop serving your code content, and a daily purge job permanently removes code text, answer text, and uploaded evidence from our systems. Free-score submissions are never stored at all — they are discarded within seconds of scoring. Details are in our Privacy Policy.

Payments you never have to worry about

Payments run entirely on Stripe. Card numbers never touch our servers, and every payment notification Stripe sends us is cryptographically signature-verified before we act on it.

Defense in depth behind the scenes

Found something?

We welcome responsible disclosure. Email info@patentprecheck.com or see security.txt. We read every report.

Questions

For security questions, contact us at:
info@patentprecheck.com
Patent PreCheck
10810 N. Tatum Blvd. #102-109
Phoenix, AZ 85028