Security & Trust
How LearnByAi keeps your documents secure
You upload contracts, financial statements, medical records, and HR files to get fast answers. Here is exactly how we handle that data, in plain language, without vague promises.
- Session-isolated storage
- TLS encrypted
- Delete on request
Last reviewed July 2026
The short version
If you only read one section, read this one. Everything below explains these six points in more detail.
- Session-isolated by design: Every document is scoped to your session or account. There is no shared workspace where files from different users mix.
- Anonymous by default: You can upload and chat with a document without creating an account. We do not ask for your name or personal details to get started.
- Your data, your control: Your files and conversations are sent to OpenAI purely to generate your answer. OpenAI's API data-handling terms apply to that data.
- Encrypted in transit: Every connection between your browser, our servers, and our storage and AI providers runs over TLS encryption.
- Never sold or shared: We do not sell documents or conversation data, and we do not share them with advertisers or data brokers.
- Deleted on request: Ask us to delete your data and we remove it from every system it touched: file storage, vector index, and database records.
Anonymous and authenticated users
LearnByAi works without an account. When you upload a document without signing in, we generate an anonymous session token stored in your browser. Every document, message, and query you create is tied to that token, and other sessions or accounts cannot retrieve it.
If you create an account, your documents and history move under your authenticated identity instead. Every request the app makes on your behalf carries your session credentials, and our backend checks them before returning any document, chunk, or chat message.
Behind both paths, documents are split by type (legal, financial, medical, HR, construction, academic, and general) into separate vector collections, and every lookup is filtered by owner ID. There is no query path that can return another user's content, whether that user is anonymous or signed in.
What happens between upload and answer
Five steps, each scoped to your document alone.
- Upload. File sent over TLS, stored in isolated cloud storage
- Extract. Text pulled from the file, OCR used if needed
- Embed. Text chunked and indexed in your document type's vector collection
- Ask. Your question retrieves only the relevant chunks from your document
- Answer. OpenAI generates a response based on passages from your document
What OpenAI sees, and what it doesn't
LearnByAi uses OpenAI's API to generate embeddings and chat answers. When you ask a question, we retrieve only the passages from your document that are relevant to that question and send those, along with your question, to OpenAI. Your entire file is not dumped into every request.
OpenAI's API data-handling terms apply to data submitted through the API.
Your chat history is kept so you can continue a conversation without re-uploading your document. It is not used for advertising, and it is not shared with any party outside the providers required to run the platform.
Where your data actually lives
LearnByAi is built on a small number of providers, each handling one part of the pipeline.
Application servers (Oracle Cloud)
Our backend and web app run on infrastructure we manage directly on Oracle Cloud, behind a reverse proxy with process-level isolation between services.
Database and auth (Supabase)
Account data, session metadata, and usage records live in a managed Postgres database. Authentication runs through Supabase Auth, which handles password hashing and session tokens.
Vector search (Qdrant)
Document text is embedded and indexed in Qdrant, split into separate collections per document type. Every read and write is filtered to the owning session or account, so a query can only ever return your own content.
File storage (Cloudinary)
Uploaded files are stored in Cloudinary and accessed only through signed, expiring URLs generated by our backend.
AI processing (OpenAI)
Embeddings and chat responses are generated through OpenAI's commercial API. Only the document passages needed to answer your specific question are sent, not your entire file history.
Card payments (Polar)
Card payments for wallet top-ups are completed on Polar's hosted checkout page. LearnByAi does not receive or store your full card number.
From upload to deletion
Every document goes through the same four stages, whether you're signed in or not.
During upload and processing
Your file is transferred over an encrypted connection and briefly held in processing memory while text is extracted and indexed. This step typically takes a few seconds.
While your session or account is active
Your document stays accessible to you for as long as your session or account remains active, so you can keep asking follow-up questions without re-uploading.
When a session goes idle
Anonymous sessions that stay inactive are cleaned up automatically. Documents tied to a signed-in account persist until you delete them.
When you request deletion
Deleting a document or account triggers a cascading removal across file storage, the vector index, and database records. Where backup copies exist, deleted data may remain in them for a limited period until they are cycled out.
What we handle, and what's on you
Security works best when both sides do their part.
What we do
- Encrypt every connection between your browser, our servers, and our storage and AI providers using TLS.
- Filter every document query by owner ID, so a request can only ever touch your own data.
- Keep production access limited to the people who need it to operate the platform.
- Patch dependencies and infrastructure regularly rather than on a fixed schedule.
- Never pass your documents to OpenAI for anything beyond answering the question you asked.
What you can do
- Use a unique password if you create an account, and avoid reusing one from another service.
- Sign out on shared or public devices instead of relying on the browser to remember you.
- Only upload documents you have the right to share, especially ones containing other people's personal data.
- Check that you are on learnbyai.app before entering login details, since we will never ask for your password by email.
- Tell us if something looks wrong. A quick report helps us fix it faster than we'd find it alone.
Found a vulnerability? Tell us first.
If you believe you've found a security issue in LearnByAi, we want to hear about it before anyone else does. Send a description and steps to reproduce it to the email below. Please avoid accessing, modifying, or deleting data that isn't yours while testing, and give us a reasonable window to fix the issue before sharing it publicly.
We don't run a paid bug bounty program at this stage, but every report gets a response, and we credit researchers who disclose responsibly.
Common security questions
Is LearnByAi SOC 2 or ISO 27001 certified?
Not yet. LearnByAi is a self-hosted platform, and we have not pursued a formal third-party security certification at this stage. What we can tell you plainly is what protections exist today: session isolation, encrypted transfer, and owner-scoped data access. We will update this page if that changes.
Do you use my documents to train AI models?
Documents and conversations are sent to OpenAI through its commercial API solely to generate your answer. OpenAI's API data-handling terms apply to data submitted through the API.
Can other users see or access my documents?
No. Every document is indexed with an owner identifier, either your anonymous session token or your authenticated account ID, and every query is filtered by that identifier at the database level. There is no shared view across sessions or accounts. Authorized LearnByAi administrators can use administrative tools that show account and usage details, uploaded file names and sizes, and previews of chat messages, and that can delete documents. We use this access to operate the service, provide support, investigate abuse and security problems, and handle billing.
What happens to my file immediately after I upload it?
It is transferred over an encrypted connection, stored in isolated cloud storage, and processed to extract and index its text. This usually takes a few seconds. From that point on, other users cannot query it.
Do you sell or share my data with third parties?
No. We do not sell documents, conversation history, or usage data, and we do not share them with advertisers or data brokers. The only third parties involved are the infrastructure and AI providers required to run the service, such as Supabase, Qdrant, Cloudinary, and OpenAI.
How do I delete my documents or account?
You can delete individual documents from within the app, which removes the file, its vector index, and related records right away. For full account deletion, email support@learnbyai.app and we will confirm once the cascading delete is complete across every system.
Is my payment information stored on your servers?
Only limited details. Card payments are completed on the hosted checkout page of our payment provider, Polar, and LearnByAi never sees or stores your full card number. Where a manual top-up option is offered at checkout, we also store the payment method, amount, and the reference you submit so we can credit your wallet.
How do I report a security vulnerability?
Email support@learnbyai.app with a description and reproduction steps. We don't run a paid bug bounty program yet, but we read every report, respond promptly, and credit researchers who disclose responsibly.
Reach the team directly
Email: support@learnbyai.app
For vulnerability reports, data deletion requests, or questions about anything on this page.
Related pages
See it work with your own document
Upload a file and ask a question. No account, no card, no data shared beyond what's needed to answer you.