It comes in. We compute it. It goes out. We delete it.
Documents, recordings, spreadsheets and archives — turned into usable data by AI running on hardware we own. The tools everyone wants, without handing your files to a cloud you can't see: nothing is used to train anything, and your files are destroyed when the job is done.
Skip the cloud. Stay in control.
Most processing services are a person at a desk with your documents open. This one isn't — the operating rules are built into the system rather than promised in a policy document. Here is the difference, line by line.
The work itself isn't unusual. What's unusual is not wanting to hand it to a stranger, or upload it somewhere you can't see. If any of these sound like your week, this was built for you.
Hundreds of scanned pages that need to be searchable, and contact details and account numbers that need masking — on material you cannot put through a free web tool.
Grievance and disciplinary audio that has to be transcribed accurately, and must not sit on a consumer transcription service afterwards.
Several hundred invoices to pull line items, totals and dates out of, where the data is commercially sensitive and the numbers have to be right.
Documents that must be processed and readable, under rules that make uploading them to somebody else's cloud a problem you don't need. We are not a HIPAA business associate by default, so a separate agreement comes first.
Years of files, and archives that may or may not still open. You want to know what's in there without a stranger looking through it.
You've seen "we may retain data as necessary" and wanted something more specific. That's the whole reason this exists.
Anyone can write "your data is deleted." Here is what you can verify yourself, and what the system records and certifies for the rest.
Every claim below is something the system produces as evidence, not something we state about ourselves.
Your destruction certificate carries the SHA-256 of the exact file we sent you. Run that check on the file in your hand and compare. If they match, the certificate refers to precisely what you received — and you didn't have to take our word for any part of it. That match proves you're holding the exact file the certificate describes; deletion itself is what the certificate and job record state, not something the hash alone can show you.
Your job's encryption key exists only in memory, is never written to disk, and is destroyed when the job finishes — not within some retention window measured in days. From that moment the working data cannot be read by anyone, including us. That isn't a policy we follow; it's arithmetic we can't undo. A separate, different secret — the delivery password shown on your results link — is what opens your finished package; that one lives until your collection window closes, then it's destroyed too.
Every step is verified automatically before anything is packaged. No person opens your files to check the work, which is also why we can't tell you what's in them. The certificate records that no human review took place.
The machine that does the heavy work has one cable, running to the other one — every other route out is blocked, and that block is checked continuously rather than asserted once in a document. If it ever stopped being true, we'd know within minutes, not whenever someone happened to notice.
Everything you send is scanned for malware before processing begins, and the certificate names the scanner and the date of its virus signatures. A file that fails is quarantined and named to you, and the rest of your job carries on. If the scanner can't run, the job stops rather than proceeding unscreened.
Not descriptions of them. The actual documents the system produces.
Whatever the job was, the same two things come back alongside your results: a destruction certificate documenting what was destroyed and when, and a completion report saying exactly what was and wasn't done. Both are generated by the job itself — nobody types them, and you get them whether you ask or not.
Not a description of one — the actual document, produced automatically by the job that made it. Every job gets one, whether you ask or not.
It carries the certificate number, the times the job was received, delivered and destroyed, and the SHA-256 of the exact file we sent you. It carries no client name and no description of what was in your files.
The figures and file names above are illustrative, not a real job's.
The same idea, pointed at the work instead of the deletion. Produced by the job itself, not written afterwards — and you get it whether the run was clean or not.
It counts what you sent against what came back, and names every file the AI couldn't read, with the reason. Nothing is quietly dropped to make the number look better. You're told exactly what was done and what wasn't, before you have to go looking for it.
No account to create. No portal to learn. No email round-trip.
The same path every job takes, whether it's ten files or ten thousand.
Pick the kind of work and its size in Choose your job below — a hundred scanned contracts, six hours of interviews, a drive nobody's opened in years. You see the price there before you ask for a link.
The button hands you a private upload link on the spot — no waiting on a reply, no sales call, no account. If a job isn't something we can do well, it isn't on the list to choose in the first place.
That link is yours alone and it expires. Files are encrypted in your browser before they are sent, each with its own key that only our machine can unwrap, so nothing readable ever crosses the internet. There is nothing to install and no account to create. The job then runs on our own hardware in an isolated workspace, encrypted at rest.
Your results come back on the same private link you sent the files on: an encrypted package, a completion report naming any file that couldn't be read, and a dated destruction certificate. That certificate is issued before your collection window even opens — it documents that your source files and working data were destroyed right after packaging, not that the package itself is gone yet. A delivery password, shown on that same link and separate from the processing key that unlocked your job, opens the package — that link is the secret, so keep it and don't forward it. Your results stay reachable there for your collection window, after which the results and the delivery password are destroyed here too. What we keep after that is a short job record and the certificate — neither contains any of your content.