Trust Centre
Your IP stays yours.
To win you funding we have to read your plans, drawings, formulas and numbers. Here’s how we keep them yours.
What we promise about your IP
You own it.
You own your files and the drafts we create for you. We claim no rights in them and use them only to provide LayUp to you.
For First Nations customers: we support you in applying the First Nations principles of OCAP® to your data — you own it, control who at LayUp can open it, can export it any time and can have it deleted. LayUp is not certified by the First Nations Information Governance Centre, and using LayUp does not by itself make a project OCAP®-compliant. OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC); see fnigc.ca.
Staff open your content only when you switch access on, and every opening is logged.
Your content isn’t used to train AI.
Anthropic is contractually barred from training on it. We switched off Deepgram’s model-improvement program on November 5, 2026 and asked Deepgram to delete audio sent before then. What each provider keeps, and for how long, is in the lists below.
You decide who sees it.
Your people, project by project. LayUp staff can open your files in four cases only: you switch on support access (72 hours), you have a Grant Analyst (only your assigned analyst, only while you leave access on), you ask for a refund (staff read only the evidence you attach), or you switch on Onboarding access for your Onboarding Specialist (only the one assigned to you, only until your set-up checklist is done). Every open shows in “Who opened this”.
You can prove what you had, and when.
Every upload gets a tamper-evident timestamp that can help show what you had and when — useful evidence in a trade-secret or ownership dispute. They are not a patent filing and do not secure patent rights or priority; talk to a patent agent. Closing a company deletes its safety deposit box, so export it first.
You know every time it’s opened.
“Who opened this” on every file: who viewed, downloaded or shared it, and when the AI read it.
You can take it and go.
Download everything in one zip. Close your company and we delete it after 30 days, apart from a few things we have to keep. The exact list is in “How long we keep things”.
How we protect it: how LayUp is built
Keep any file from AI
Mark a file and the AI never reads it, anywhere. We also delete the text we had already pulled out of it. Describe it in your own words instead.
Project-level access
Invite people to the whole company or just one project.
Two-step sign-in before anything sensitive
An authenticator app is required before anyone shares a sensitive file. LayUp staff always use one.
Staff locked out, with four doors
LayUp staff see your account details and charges. They open your files only with support access you switch on for 72 hours, as your assigned Grant Analyst while you leave that access on, to read the evidence you attach to a refund request, or as your Onboarding Specialist while Onboarding access is on. Every open shows in “Who opened this”.
A certificate and an access record on every upload
Each upload gets a timestamped certificate: proof of what you gave us and when. The access record shows who opened it, downloaded it, shared it, or had the AI read it. It can’t be edited or deleted.
Safety deposit box
Share links that expire, every version kept and timestamped, six-year retention and legal hold, for the files that matter most.
Stored in Canada
Your files and database sit on Amazon Web Services (AWS), Canada (Central) region, Montréal, managed through Supabase. They are encrypted when stored and every time they move. The AI, speech-to-text and video providers process data outside Canada: see the list below.
What the access rules cover
The same rules, per company and per project, apply everywhere a file can be reached, not just on the Files page.
Previews and downloads
Only people in your company, and for a project’s files only people who can see that project. Each preview and download is recorded.
Everything the AI reads
Search, ranking the passages that answer a question, drafting, research and the Bookkeeper all go through the same check. A file kept from AI is refused on every one of them. So is an archived file. The AI reads a project’s own files and company-wide files, never another project’s.
Share links
Only for files in your safety deposit box. A link goes to one email address, needs a code sent to it, lasts 1 to 90 days, and you can revoke it. A link stops working the moment the file leaves the box.
The zip of everything
Only the owner can ask for it. We email a link that works for 24 hours.
Your Grant Analyst
Only the one analyst assigned to your company, only while your plan is on, and only while the access switch is on. The switch is yours: an owner or admin can turn it off any time and the analyst is refused from then on. Chat and meetings carry on. When the plan ends, so does the access.
Your Onboarding Specialist
Free, and only if you switch it on: Onboarding access. The one specialist assigned to you can then upload files, fill in your company profile and draft your first project, and read your files to do that work. They can never touch your applications, answers, billing, submissions, team or settings, and they can never mark a checklist item done: that click is yours. Every action shows in “Who opened this” and your file trail as “Onboarding Specialist (name)”. You can switch it off any time in Your account → Team, and it ends by itself when your checklist is done.
Keeping a file from AI after the AI has read it
From that moment every way the AI reads your files refuses it.
We also delete the text and passages we had pulled out of the file to search it. The file itself stays where it is, and it stays in your zip.
Drafts we already wrote using it stay until you edit them.
Who sees your files
We don’t run our own servers. Your data sits with large, audited cloud providers, and these are the services we use to manage it. Your files and database are on Amazon Web Services (AWS), Canada (Central) region, Montréal, managed through Supabase. The AI, speech-to-text and video providers below process data outside Canada. Here is every service that can see your information, what it sees, where, how long it keeps it, and what its own documents say. Where a provider’s documents are silent, we say so.
Supabase
Database, file storage and the background functions that do the work
- What it sees
- Everything you store in LayUp, encrypted (AES-256 when stored, TLS in transit).
- Where it processes data
- Database and files: Amazon Web Services (AWS), Canada (Central) region, Montréal, managed through Supabase. Our functions run in the Supabase region closest to whoever calls them; we don’t pin them to Canada.
- How long it keeps it
- Until you delete it or close your company. Daily database backups, kept 7 days. A restore goes back to the last daily backup, so up to 24 hours of changes could be lost. Uploaded files are stored separately and aren’t covered by database backups.
- Trains on it?
- We use it only to store and serve data. No AI runs in it.
- Can its staff access it?
- Supabase’s public security page doesn’t say who on its team can reach customer data.
Anthropic
AI: reads your files and writes your drafts; also searches the public web when it researches a program
- What it sees
- Files you haven’t kept from AI, your answers and drafts, and the questions we ask it.
- Where it processes data
- United States
- How long it keeps it
- Anthropic says it deletes inputs and outputs within 30 days. If its safety systems flag a conversation as breaking its Usage Policy it can keep that for up to 2 years (and its classification scores for up to 7).
- Trains on it?
- Prohibited by contract
- Can its staff access it?
- Anthropic’s public documents don’t say who on its team can read API data.
Deepgram
Speech-to-text: SR&ED walkthroughs you record, Grant Analyst meeting audio, and spoken questions to the explainer
- What it sees
- The audio of those recordings, and the text it turns into.
- Where it processes data
- Outside Canada (global service; no country named)
- How long it keeps it
- We opt every request out of Deepgram’s model improvement program. For opted-out requests Deepgram says audio, text and transcripts are kept only for the time needed to process the request, though it still records request details and usage logs. Audio sent before we added the opt-out isn’t covered by this.
- Trains on it?
- Opted out on every request since Nov 5, 2026
- Can its staff access it?
- Deepgram says data is processed only by Deepgram and its published sub-processors.
Daily
Video meetings with your Grant Analyst: video, screen sharing and the audio recording
- What it sees
- The live meeting (video, audio, screen share and chat) and an audio-only recording. Screen shares are never recorded.
- Where it processes data
- AWS, worldwide; we delete each recording from Daily once it is transcribed
- How long it keeps it
- Daily doesn’t publish how long it keeps recordings. We delete ours from Daily as soon as the transcript is saved. If writing it up fails five times we stop trying, and the recording isn’t deleted automatically.
- Trains on it?
- Not addressed in its documents; written confirmation requested
- Can its staff access it?
- Daily says its employees can never see your video calls.
Microsoft Azure Speech
The assistant’s voice (text-to-speech), when you ask it to read one of your saved answers aloud
- What it sees
- The text of that answer. Nothing else.
- Where it processes data
- Canada (Microsoft Azure, Canada Central)
- How long it keeps it
- Microsoft says it doesn’t keep the text we send to its real-time speech service, or the audio it makes. We keep a copy of the audio in our own private storage so it can play again.
- Trains on it?
- Microsoft’s documents describe no training on text sent to its real-time speech service.
- Can its staff access it?
- Microsoft’s page on this doesn’t say who on its team can see it.
Vercel
Hosts the website and the app
- What it sees
- The pages you open and the forms you submit. Files don’t pass through it: downloads go straight from storage to your browser.
- Where it processes data
- United States (AWS) and global edge network
- How long it keeps it
- We store no files or answers in it.
- Trains on it?
- We use it only to host the site. No AI runs in it.
- Can its staff access it?
- Vercel’s compliance page doesn’t say who on its team can see customer data.
Resend
Sends our emails: invites, reminders, deadlines, meeting notices
- What it sees
- Your email address and the emails we send. Emails carry links, never your files.
- Where it processes data
- United States
- How long it keeps it
- Resend says it keeps email and log data for 30 days on its Free, Pro and Scale plans, and deletes the rest within 90 days after an account closes.
- Trains on it?
- Resend’s security page doesn’t mention training AI on it.
- Can its staff access it?
- Resend’s security page doesn’t say who on its team can read email content.
Stripe
Payments
- What it sees
- Your card details, which go straight to Stripe and never touch our servers, plus your company name, email and what we charge.
- Where it processes data
- Not named in its documents
- How long it keeps it
- Stripe keeps payment records under its own retention policy. We keep your invoices as set out below.
- Trains on it?
- Stripe’s security page doesn’t mention training AI on it.
- Can its staff access it?
- Stripe says card numbers sit in an isolated environment that only a small number of trained engineers can reach, with access reviewed every quarter.
Microsoft 365
Email to our staff
- What it sees
- Email our staff send and receive, including replies from you.
- Where it processes data
- Canada and United States
- How long it keeps it
- Under our own mailbox settings.
- Trains on it?
- n/a
- Can its staff access it?
- Microsoft’s public documents don’t say who on its team can read mailbox content.
DigiCert
Signs the time on an upload timestamp
- What it sees
- Only a fingerprint (SHA-256) of the file. Never the file.
- Where it processes data
- Wherever DigiCert runs its timestamp service.
- How long it keeps it
- It signs a time and replies. We keep the reply with the file.
- Trains on it?
- It never receives your file, so there is nothing to train on.
- Can its staff access it?
- It sees only the fingerprint.
FreeTSA
The backup timestamp service, used only if DigiCert doesn’t answer
- What it sees
- Only a fingerprint (SHA-256) of the file. Never the file.
- Where it processes data
- Wherever FreeTSA runs its service.
- How long it keeps it
- It signs a time and replies. We keep the reply with the file.
- Trains on it?
- It never receives your file, so there is nothing to train on.
- Can its staff access it?
- It sees only the fingerprint.
Services you connect
We read from these only after you connect them. They already hold your files; their own rules apply to what they keep.
- Microsoft OneDrive and SharePoint: Pick files from your drive into an SR&ED claim. Microsoft Trust Center
- Dropbox: Pick files from your Dropbox into an SR&ED claim. dropbox.com/security
- GitHub: Read your code history as SR&ED evidence. github.com/security
- Google Drive: Pick files from your Drive in your browser. safety.google
Questions about a provider? Write to privacy@layup.fund.
Grant Analyst meetings
Recorded and transcribed
Grant Analyst meetings are recorded as audio only and turned into a transcript. What is shown on a shared screen isn’t recorded.
Everyone is told
The join screen says the meeting is recorded and transcribed before anyone joins, and a “Recorded and transcribed” badge stays on screen during the call.
Where the transcript goes
Into your company’s files, in the project the meeting was booked under, like any other file: it has an access record and you can keep it from AI.
Where the audio goes
Daily records it and Deepgram turns it into text; both process data outside Canada (see the list). We delete the recording from Daily as soon as the transcript is saved.
How long we keep things
The same table is what our Terms and Privacy Policy point to.
| What | How long |
|---|---|
| Closing your company | Only the owner can close it, once billing is settled. We delete your files and content 30 days later. You can cancel any time in those 30 days. We keep: files on legal hold, your invoices and payment records, the access record, and the record of the closure itself. |
| Safety deposit box files | While your company is open, nobody in it can delete a boxed file for six years after it went in (a new version starts the six years again). A legal hold keeps it until you lift the hold. If you close your company, boxed files are deleted with everything else after 30 days unless they are on legal hold. |
| Invoices and payment records | Kept after you close, for six years. |
| The access record on each file | Kept after the file is deleted and after you close. It can’t be edited or deleted, and we have no schedule for removing it. |
| Meeting recordings and transcripts | The recording is deleted as soon as the transcript is saved (if the write-up fails five times, it isn’t deleted automatically). The transcript is a file in your project: it stays until you delete it or close your company. |
| Backups | Daily database backups, kept 7 days. A restore goes back to the last daily backup, so up to 24 hours of changes could be lost. Uploaded files are stored separately and aren’t covered by database backups. Deleted data stays in our backups for up to 7 days. A file you delete may not be recoverable (storage keeps no earlier versions of a file, and files aren’t in the database backups). |
| What each provider keeps | Anthropic: deleted within 30 days, up to 2 years if flagged. Deepgram: only while it processes the request (with our opt-out). Daily: we delete the recording at once. Microsoft Speech: nothing. Resend: 30 days. Stripe: its own policy. The list above has the detail. |
Records you can rely on
The access record can’t be rewritten
It is insert-only. The database refuses any edit or delete of a row, and even our own system accounts are denied that permission. It outlives the file: a deleted file keeps its record. It doesn’t stop someone holding the database’s owner credentials. Every open by LayUp staff is written to the same record.
What an upload timestamp is
We work out a fingerprint (SHA-256) of your file and send only that to a timestamp authority. It signs the fingerprint with the time. We check the signature against that authority’s published certificate before we accept it, and give you the signed reply, so anyone can check it with standard tools and without us. Change one byte and the fingerprint no longer matches.
What it does not prove
That a file with exactly that fingerprint existed at that time. It doesn’t say who made it, who owns it, or that what it says is true. It is evidence, not a legal ruling.
If something goes wrong
We tell affected customers within 72 hours of confirming a breach that affects their information, and report to the Privacy Commissioner as the law requires.
Daily database backups, kept 7 days. A restore goes back to the last daily backup, so up to 24 hours of changes could be lost. Uploaded files are stored separately and aren’t covered by database backups, so a file deleted from storage can’t be restored from them. Your own zip of everything is the copy you hold.
Independent checks
LayUp itself has not had an independent audit yet.
Supabase, Vercel, Daily, Deepgram, Resend and Stripe each say on their own pages that they hold an independent SOC 2 report. The links in the list go to those pages, where you can ask for the reports. Amazon Web Services, which Supabase, Vercel and Daily run on, publishes SOC 2 and ISO 27001 reports too (link in the list).
An outside security test is planned. We will post the date once the test is booked.
Found a problem?
Email security@layup.fund. We reply within 2 business days, and good-faith research is welcome.