Where your data is processed
We are based in India, and so is our core hosting. The AI processing that reads your disclosure and writes the draft happens in the EU. In full:
| Where | What runs there |
|---|---|
| EU: Azure Sweden Central and Italy North | AI models for drafting and search (Azure OpenAI) |
| EU: Langfuse Cloud, PostHog EU | AI request tracing, kept 30 days; product analytics, only with your consent |
| India: Azure Central India | The app, its database, file storage, background jobs and transactional email |
| India: AWS ap-south-1 (Mumbai) | The public patent index and search event analytics |
| Global edge: Cloudflare | Site delivery, bot protection and the AI gateway |
| United States: Sentry, Dodo Payments | Error monitoring; payments and invoicing as merchant of record |
The sub-processors page is the authoritative list, including sign-in providers, email delivery and the patent office data sources. Transfers out of the EEA rely on the European Commission's Standard Contractual Clauses, and on the EU-US Data Privacy Framework where a provider is certified under it.
AI and your data
Your invention content is not used to train any model, not ours and not the provider's. Drafting and search run on Azure OpenAI deployments in Sweden Central and Italy North under Microsoft's enterprise terms; Microsoft documents its commitments in Data, privacy, and security for Azure OpenAI Service. The only material we use to improve our own models is publicly published or granted patent documents. AI output is a draft: a person reviews and edits it before anything is filed, and we make no automated decisions with legal effect.
Security controls
Encryption
Every connection uses TLS 1.2 or later. Databases, backups and uploaded files are encrypted at rest with AES-256, at the infrastructure level, and it cannot be switched off.
Account isolation
Each user has their own account, and invention disclosures, drafts, claims and figures are scoped to the user who created them. Users cannot see each other's work, and customer data is not pooled into shared datasets.
Access control
Role-based authorization enforced at the API layer, on the principle of least privilege. Production environments are isolated, and calls between our services are signed.
Staff access
Our team does not see your patent content in normal operation. Access to production databases needs explicit, logged authorization and is used only for critical debugging. Everyone we authorize to process data is bound by confidentiality.
Sign-in
Session-based authentication with secure, HTTP-only cookies, not long-lived tokens in the browser. You can sign in with Google or Microsoft if you prefer.
Monitoring and backups
Logging and error monitoring across services, regular encrypted backups with point-in-time restore, and review of the vendors we use.
Certifications
PatentAssist does not itself hold SOC 2 or ISO 27001 certification. Our infrastructure runs on Microsoft Azure and Amazon Web Services, which hold SOC 2 and ISO 27001 certifications for the infrastructure layer. We say this plainly because security questionnaires ask, and the answer should not be a surprise. If your review needs more, the DPA lets you request information and audit us; write to privacy@patentassist.ai.
GDPR and the data processing agreement
For the content you upload, including personal data about inventors and applicants, you are the controller and we are your processor under Article 28 GDPR. Our data processing agreement applies to every account. Its main terms:
- We process personal data only on your documented instructions.
- Breach notice without undue delay and in any event within 48 hours.
- At least 30 days' notice before adding or replacing a sub-processor, with a right to object and, if it cannot be resolved, to terminate with a pro-rated refund.
- Standard Contractual Clauses (Decision 2021/914), Module Two and Module Three, plus the UK International Data Transfer Addendum where relevant.
- Audits once every twelve months, scheduled 30 days ahead, or more often after a breach or at a supervisory authority's request.
- On termination, deletion or return of your data; live data within 30 days, backups within 90.
Do not upload special categories of personal data (Article 9 GDPR); the service is not designed for it. Our privacy policy covers our own processing, including India's Digital Personal Data Protection Act, 2023.
| Data | Kept for |
|---|---|
| Your account and invention content | As long as your account is open |
| AI job payloads and step logs | 30 days after the job completes, then the payload is erased |
| AI request tracing (Langfuse) | 30 days |
| Error monitoring (Sentry) | 90 days |
| After you close your account | Live data deleted within 30 days; backups expire within 90 days |
You can export or delete your data yourself in the app under Settings, Security.
Why confidentiality before filing matters
At the EPO, the state of the art is everything made available to the public before the filing date (Article 54(2) EPC). The US gives inventors a one-year grace period for their own disclosures (35 U.S.C. 102(b)(1)), but that does not protect European rights. A draft that leaks before filing can therefore destroy novelty in Europe outright.
Our terms of service treat all invention details you provide as confidential information: we protect it with at least a reasonable standard of care, use it only to provide the service, and do not disclose it except as the terms allow or the law requires, in which case we give you notice so you can contest it. You keep full ownership of your inputs and of the drafts generated from them.
US inventions: foreign filing licenses and export control
US practitioners ask about this because our hosting is outside the United States. These are the provisions that come up. They are pointers, not advice; whether a given upload is an export is a question for your own counsel.
- 35 U.S.C. 184: for an invention made in the United States, no application may be filed abroad within six months of the US filing without a license from the USPTO. 35 U.S.C. 185 bars or invalidates a US patent where that license was not obtained, unless the failure was through error and the subject matter is not within section 181.
- 37 CFR 5.11(a)-(b): the license is needed before a foreign filing when the US application was filed less than six months earlier or not at all, and it also authorizes exporting technical data abroad for preparing, filing and prosecuting a foreign application.
- 37 CFR 5.11(c): exports of technical data for foreign filing without that license must comply with the International Traffic in Arms Regulations (22 CFR parts 120-130), the Export Administration Regulations (15 CFR parts 730-774) and 10 CFR part 810, unless a US application has been on file for at least six months without a secrecy order.
- 37 CFR 5.11(d): an application under a secrecy order cannot be exported or filed abroad except as 37 CFR 5.5 allows. Do not upload such material to any third-party service without clearance.
- MPEP 140 explains foreign filing licenses in practice, including the license usually granted on the filing receipt.
What we can give you is the facts: your content is stored in Azure Central India and sent for AI processing to Azure OpenAI in Sweden and Italy, through the providers named on the sub-processors page. For the filing side, see our guide to the US provisional application.
Security questions
Does PatentAssist train AI on my invention disclosures?
No. Your disclosures, drafts and claims are never used to train or fine-tune any model, ours or the provider's. The models run on Azure OpenAI, whose enterprise terms rule out training on customer prompts and outputs. The only material we use to improve our own models is publicly published or granted patent documents.
Where is my data stored?
The app, its database and your uploaded files are hosted in Azure Central India. The AI models that draft and search run on Azure OpenAI in Sweden Central and Italy North. The public patent index is on AWS in Mumbai. The sub-processors page lists every provider and region.
Is PatentAssist SOC 2 or ISO 27001 certified?
No. PatentAssist does not itself hold SOC 2 or ISO 27001 certification. Our infrastructure runs on Microsoft Azure and Amazon Web Services, which hold those certifications for the infrastructure layer.
Do you sign a data processing agreement?
An Article 28 GDPR data processing agreement applies to every account automatically and is published at /dpa/. It includes the Standard Contractual Clauses for transfers out of the EEA. If you need a countersigned copy, write to privacy@patentassist.ai.
How quickly will you tell us about a breach?
Without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need for your own notification under Article 33 GDPR.
Can I delete everything?
Yes. You can export or delete your data in the app under Settings, Security, or by writing to privacy@patentassist.ai. Deleting a patent application removes it from the database and queues its files for permanent deletion. When an account is closed, live data is deleted within 30 days and backups expire within 90.
Does uploading a US invention need a foreign filing license?
We cannot answer that for you. 37 CFR 5.11 governs filing abroad and exporting technical data for foreign filing, and other exports fall under the export control regulations it names. Our data is processed in India and the EU, as listed on the sub-processors page, so you can give your export-control counsel the facts they need.
Sources: our data processing agreement, sub-processors, privacy policy and terms of service; Regulation (EU) 2016/679; Decision (EU) 2021/914; Article 54 EPC; 35 U.S.C. 102, 184 and 185; 37 CFR 5.11; MPEP 140. Checked October 26, 2026. More background in Privacy: by law and by design. This page is general information, not legal advice.