How LearnByAI keeps your documents secure
You upload contracts, financial statements, medical records, and HR files to get fast answers. Here is exactly how we handle that data, in plain language, without vague promises.
Last reviewed July 2026
At a Glance
The short version
If you only read one section, read this one. Everything below explains these six points in more detail.
Session-isolated by design
Every document is scoped to your session or account. There is no shared workspace where files from different users mix.
Anonymous by default
You can upload and chat with a document without creating an account. We do not ask for your name or personal details to get started.
Never used for AI training
Your files and conversations are sent to OpenAI purely to generate your answer. They are not used to train any model, ours or anyone else's.
Encrypted in transit
Every connection between your browser, our servers, and our storage and AI providers runs over TLS encryption.
Never sold or shared
We do not sell documents or conversation data, and we do not share them with advertisers or data brokers.
Deleted on request
Ask us to delete your data and we remove it from every system it touched: file storage, vector index, and database records.
Access Control
Anonymous and authenticated users
LearnByAI works without an account. When you upload a document without signing in, we generate an anonymous session token stored in your browser. Every document, message, and query you create is tied to that token, and only that token can retrieve it.
If you create an account, your documents and history move under your authenticated identity instead. Every request the app makes on your behalf carries your session credentials, and our backend checks them before returning any document, chunk, or chat message.
Behind both paths, documents are split by type (legal, financial, medical, HR, construction, academic, and general) into separate vector collections, and every lookup is filtered by owner ID. There is no query path that can return another user's content, whether that user is anonymous or signed in.
Data Flow
What happens between upload and answer
Five steps, each scoped to your document alone.
Upload
File sent over TLS, stored in isolated cloud storage
Extract
Text pulled from the file, OCR used if needed
Embed
Text chunked and indexed in your document type's vector collection
Ask
Your question retrieves only the relevant chunks from your document
Answer
OpenAI generates a grounded response, cited to your source
AI Processing
What OpenAI sees, and what it doesn't
LearnByAI uses OpenAI's API to generate embeddings and chat answers. When you ask a question, we retrieve only the passages from your document that are relevant to that question and send those, along with your question, to OpenAI. Your entire file is not dumped into every request.
Under OpenAI's API terms, data submitted through the API is not used to train their models. We do not fine-tune any model on your documents either. The context sent to the API exists only for the duration of that request.
Your chat history is kept so you can continue a conversation without re-uploading your document. It is not used for advertising, and it is not shared with any party outside the providers required to run the platform.
Infrastructure
Where your data actually lives
LearnByAI is built on a small number of providers, each handling one part of the pipeline.
Application servers (Oracle Cloud)
Our backend and web app run on infrastructure we manage directly on Oracle Cloud, behind a reverse proxy with process-level isolation between services.
Database and auth (Supabase)
Account data, session metadata, and usage records live in a managed Postgres database. Authentication runs through Supabase Auth, which handles password hashing and session tokens.
Vector search (Qdrant)
Document text is embedded and indexed in Qdrant, split into separate collections per document type. Every read and write is filtered to the owning session or account, so a query can only ever return your own content.
File storage (Cloudinary)
Uploaded files are stored in Cloudinary and accessed only through signed, expiring URLs generated by our backend. Cloudinary maintains its own SOC 2 Type II certification as a storage provider.
AI processing (OpenAI)
Embeddings and chat responses are generated through OpenAI's commercial API. Only the document passages needed to answer your specific question are sent, not your entire file history.
File Lifecycle
From upload to deletion
Every document goes through the same four stages, whether you're signed in or not.
During upload and processing
Your file is transferred over an encrypted connection and briefly held in processing memory while text is extracted and indexed. This step typically takes a few seconds.
While your session or account is active
Your document stays accessible to you for as long as your session or account remains active, so you can keep asking follow-up questions without re-uploading.
When a session goes idle
Anonymous sessions that stay inactive are cleaned up automatically. Documents tied to a signed-in account persist until you delete them.
When you request deletion
Deleting a document or account triggers a cascading removal across file storage, the vector index, and database records. Most deletions finish immediately, and any remaining backups are cleared within 30 days.
Shared Responsibility
What we handle, and what's on you
Security works best when both sides do their part.
What we do
- ✓Encrypt every connection between your browser, our servers, and our storage and AI providers using TLS.
- ✓Filter every document query by owner ID, so a request can only ever touch your own data.
- ✓Keep production access limited to the people who need it to operate the platform.
- ✓Patch dependencies and infrastructure regularly rather than on a fixed schedule.
- ✓Never pass your documents to OpenAI for anything beyond answering the question you asked.
What you can do
- →Use a unique password if you create an account, and avoid reusing one from another service.
- →Sign out on shared or public devices instead of relying on the browser to remember you.
- →Only upload documents you have the right to share, especially ones containing other people's personal data.
- →Check that you are on learnbyai.app before entering login details, since we will never ask for your password by email.
- →Tell us if something looks wrong. A quick report helps us fix it faster than we'd find it alone.
Responsible Disclosure
Found a vulnerability? Tell us first.
If you believe you've found a security issue in LearnByAI, we want to hear about it before anyone else does. Send a description and steps to reproduce it to the email below. Please avoid accessing, modifying, or deleting data that isn't yours while testing, and give us a reasonable window to fix the issue before sharing it publicly.
We don't run a paid bug bounty program at this stage, but every report gets a response, and we credit researchers who disclose responsibly.
FAQ
Common security questions
Security Contact
Reach the team directly
For vulnerability reports, data deletion requests, or questions about anything on this page.
See it work with your own document
Upload a file and ask a question. No account, no card, no data shared beyond what's needed to answer you.