Text verification flow
1. Receive
The API receives submitted content over the service boundary and assigns a request ID.
2. Extract
Claim extraction identifies factual spans. The original may be retained encrypted for the selected period, or omitted under zero retention.
3. Retrieve and judge
Claim-shaped queries and relevant content are sent to configured retrieval and model providers. Do not submit secrets or unnecessary sensitive data.
4. Return and expire
The structured result is returned, retained according to configuration, then made inaccessible and cryptographic payload material is removed by cleanup.
Document flow
The document is encrypted after validation, extracted locally, and de-identified locally before material is sent to external verification providers. The original upload payload is discarded after processing. Zero source retention removes it at the extraction boundary and creates no source-context preview, page thumbnail, or annotated copy; derived job status and the structured result remain retrievable for no more than one hour so the asynchronous operation can finish.
Identifiers and logs
Operational records use request IDs, object IDs, hashes and aggregate counts. Logs and audit events must not contain full submitted content, evidence passages, tokens, email sign-in links or API secrets.
Accounts
Email addresses are used for passwordless sign-in and account operation. Single-use magic links expire after 15 minutes. Sessions expire after 30 days and can be revoked. Organizational role and API-key metadata support access control.
Retention controls
The public interface supports zero source retention, 24 hours, 7 days, and 30 days. Organizations can adopt a narrower default. Zero source retention is not zero metadata: one-hour asynchronous result availability plus records required for fraud prevention, accounting, security and tamper-evident audit may remain without the submitted payload.
Regulated data
The public service is not represented here as suitable for regulated health, legal privilege, payment-card, government-classified or similarly restricted data. A private deployment and appropriate agreements and controls are required before such use.