Security and data flow
This page is written for IT departments and data protection officers. It explains what VetCaseAudit actually does. The binding document is the privacy statement. This page contradicts it nowhere and does not replace it.
Data flow
Three stations, and only one of them is outside your control and ours: the language-model provider for which the organisation that uses the application stores its own access key.
What is stored
On the server: the uploaded file (for DOCX, additionally the PDF version generated server-side), the full text extracted from it with its page mapping, the analyses with their verdicts and rationales, and the supporting quotes. Supporting quotes are verbatim excerpts from the manuscript. Plus users' account data and their membership of the institution.
The institution is a shared workspace: documents are visible to its members, and every document shows who uploaded it.
Deletion is possible at any time and takes effect immediately: deleting a document removes the database record and the files on the server, and the analyses and supporting quotes attached to it go with them. That also holds for a document that is currently being processed or has finished processing. There is no state in which a document can no longer be deleted.
A download never runs over a permanently valid address: the application generates a signed link that expires after 120 seconds.
There is currently no automatic deletion period. What remains stored remains until the institution deletes it. The complete list of retention periods is in the privacy statement, section 6.
Backups
Both halves are backed up together: a pg_dump of the database and an archive of the document store. That is not thoroughness for its own sake. The character positions of the supporting quotes live in the database, and the files they point into live on disk. A backup of only one half would produce a restore in which the quotes point at nothing: visibly broken, and precisely at the place where the application is supposed to demonstrate that it holds up. The backup script therefore publishes no snapshot with a half missing, and the restore script refuses such a snapshot.
Backups are kept for 14 days. The restore is not merely intended but has been rehearsed against a disposable stack set up for the purpose: create known data, back up, destroy, restore, check that it is back. The log of that run is in the operations manual with its date, and it is extended on every repeat. An untested backup is an assumption, not a backup.
Provider keys: the key ladder
Every analysis needs an access key for the language-model provider. VetCaseAudit looks for one in a fixed order:
- The organisation's key, stored by an administrator, valid for all members of the same organisation.
- A personal key, stored by the individual, if the organisation does not keep a shared one.
GWDG SAIA (Gesellschaft für wissenschaftliche Datenverarbeitung mbH Göttingen, endpoint https://chat-ai.academiccloud.de/v1, processing in Germany) is the recommended provider. The reason VetCaseAudit keeps no key of its own for GWDG is a property of SAIA: SAIA keys are personal. An operator key would be one particular person's key, with other people's analyses running over it. The usage relationship is between the organisation that uses it and GWDG.
GWDG SAIA is the expected path. If a stored OpenAI key is used, manuscript chunks go to OpenAI. Other OpenAI-compatible endpoints are not supported in version 1 and are not addressed. They are untested, and an untested provider in a list is a promise nobody has checked.
Stored keys are encrypted at rest and held in clear text only in memory, for as long as a single provider call runs. They appear in no log and are never displayed again in the interface, not even to the person who entered them.
Analyses on your institution's key are not billed. What the provider costs, the provider settles with your institution. VetCaseAudit does not meter that consumption as a service of its own.
Transport and access
The connection is TLS-encrypted throughout. Certificates are obtained automatically via Let’s Encrypt. Access comes about exclusively through an invitation from an institution. There is no public self-registration. Sign-in attempts and the other sensitive endpoints are rate-limited.
Within an institution there are three roles:
- Member
- uploads documents, starts analyses, reads reports.
- Institution administrator
- additionally: manages the members and stores or removes the institution's provider key.
- Operator administrator
- the operator side: creates institutions, sets capacity limits, deactivates accounts.
Every administrative change is logged, with the person acting, the time, the object affected and the kind of change. The log is not there to replace trust. It is there so that a question of "who changed that, and when" has an answer.
Hosting, email and subprocessors
The public site is a static export. The application runs on a VPS under the operator named in the Impressum. Subprocessors for email and hosting will be named here when they are contracted. They are not used on the static pages.
For language-model analysis, manuscript text goes to GWDG (Gesellschaft für wissenschaftliche Datenverarbeitung mbH Göttingen), only with a stored key, processed in Germany. If a stored OpenAI key is used, manuscript chunks go to OpenAI. TLS certificates come from Let’s Encrypt (Internet Security Research Group). The data transmitted are the domain name and the operator's contact address.
What this website itself does
Nothing that would require consent. This website sets no cookies, uses no local storage, embeds no analytics or tracking services, and loads not one resource from a third-party server: no fonts, no scripts, no maps, no images. That is also why there is no cookie banner here. There is nothing to consent to.
That is not a statement of intent but a verified property. On every build of this website, the check suite searches the generated output for references to third-party servers and fails if it finds one. An accidentally pasted embed snippet would not get through. The only deliberate exception is links you click yourself. A link loads nothing until you use it.
The single exception to “nothing is transmitted” is the contact form under /request-access: what you enter there is submitted to the application when you send it, to the same origin, not to a third party.