PATHREADER AI //

Back to Trust Center

Security overview

Rules come from your own policy documents. When you ask PathReader to extract rules, it uses an AI provider key you configure; there is no PathReader-key fallback. Your team approves every proposed rule before it takes effect, and rules are applied by deterministic policy evaluation: your published rules decide whether a rule matched, not a model.

How the product handles your data

  1. Employee device Prompts and files go from the machine to your provider. Responses come straight back.
  2. Your AI provider Receives the request under your own account.
  3. PathReader Metadata only: which rules matched, when, and on which machine.

Infrastructure

The PathReader service runs on Cloudflare (Pages, Workers, D1 and R2), with policy publishing and evaluation as separate services.

Encryption

Traffic to the service uses HTTPS.

PathReader encrypts provider API keys, uploaded documents, extracted text and source quotations with AES-256-GCM, using a dedicated data-encryption key kept separate from session-signing secrets, with separate derived keys per data type. This is in addition to Cloudflare's encryption at rest.

Access control

  • Workspaces are isolated from one another.
  • Access is authorized by session membership or a machine's enrollment; knowing an identifier does not grant access.
  • Workspace roles (owner, editor, viewer) are separate from PathReader staff administration.
  • Staff supporting a workspace work in a distinct support context, and impersonation requires a recorded reason.
  • Machines authenticate with per-machine signed requests.
  • Every person signs in with a PathReader account protected by required multi-factor authentication. Single sign-on (SAML/OIDC) and SCIM user provisioning are not yet supported.

Audit evidence and recovery

Governance and evaluation records are hash-chained, with verification and anchoring for supported streams.

Database restores are verified monthly: the production database is restored into an isolated environment and checked for matching contents, schema and audit chains.

Data retention

  • Retention is configurable per workspace, with a separate window for device telemetry.

Report a security issue

Write to security@pathreader.ai.

Please do not include secrets or production data in an initial report.

Reports are acknowledged within 48 hours.

Back to Trust Center