Data security
What TrueCite can see, what it keeps, and who else sees anything. Last reviewed against the code: 26 September 2026.
TrueCite only receives the citation details you choose to send it. It has no access to your email, files, calendar, chats or accounts, and nothing in TrueCite (including the AI connector) is able to reach them.
The short version
- Documents you check on this website are read in your browser. We receive the citations you review and submit, not the document.
- We receive citations, an optional case name, an optional document fingerprint (a hash) and a label.
- Our AI connector for Claude, ChatGPT and other MCP clients sees only what your AI assistant puts into a TrueCite tool call. It has no tool for opening files, reading mail or browsing your conversation.
- We store each check on our servers in Singapore, outside the United Kingdom. Your records are kept until you ask us to delete them: if you have an account, email info@truecite.uk from your account email address. Checks run on the Try page without an account are not linked to any account; to ask us to delete one, email info@truecite.uk with the citation you checked and the approximate date and time of the check.
- Each United Kingdom citation causes one lookup of that judgment at Find Case Law, The National Archives. A case name you give is compared on our server. Only if Find Case Law has no record at that citation, one word of the case name and the court are sent to Find Case Law to search its records by name. If Find Case Law has no record, that citation and any case name you gave may be sent to a web search provider. Nothing else from your document goes with it.
- We use no AI model to make findings, send nothing to AI model providers, and train nothing on your data.
What we receive, by product
- Try page (no account). One citation and, if you type one, a case name.
- Signed-in check. Your .docx, .pdf or .txt file is opened in your browser; PDFs are read with a copy of PDF.js served from this website. We receive the list of citations you review and submit (up to 100), a SHA-256 fingerprint of the extracted text, and a report label. The label is filled in with the file name; you can change it before you check. The document text itself is not sent.
- Partner API (/api/v2). The same fields: citation items, an optional fingerprint and an optional label. Any other field is refused with an error. Each citation is limited to 2,048 bytes.
- AI connector (Claude, ChatGPT). The arguments of the tool your assistant calls, and nothing else. Details below.
- Your account. Firm name, SRA or Companies House number, contact name and email address. Sign-in uses emailed one-time codes; we store only a hash of each code, and there is no password.
- Payments. Card details are entered on Revolut's hosted page and never reach us. We keep the Revolut order number and payment status.
What we never receive
- The text of a document you check on this website, including quotations and submissions.
- Your email, files, calendar, contacts, chat history or AI conversations.
- Card numbers or passwords.
One honest limit: a citation field is free text of up to 2,048 bytes. Whatever is typed or pasted into it, or whatever an AI assistant puts into it, is received and stored like any citation. Put only citations and case names there.
A Clio Manage integration exists in the code. It would read a document your firm picks in Clio on our server, in memory only. It is not switched on for this service today, and this page will say so when that changes.
Why the AI connector cannot read your other files, email or chats
- The connector is a remote service at truecite.com.au/mcp. Your AI assistant sends it requests over HTTPS; it has no access to your computer, your AI account or any other service.
- It offers four tools with fixed inputs, and rejects any argument that is not in the tool's schema: get_coverage (no input), get_usage (no input), verify_citation_identities (citations, optional label and fingerprint) and verify_entity_identities (Australian Business Numbers with optional names). None of them opens files, reads mail, browses the web for you or reads your conversation.
- Three tools are marked read-only. verify_citation_identities records the check in your TrueCite account, like a check made on this website. It writes only to TrueCite's own records.
- Connecting uses TrueCite's own sign-in. It grants two permissions, citations:verify and usage:read, and never asks for access to a Google, Microsoft, Anthropic or OpenAI account. We store connector tokens only as hashes. An access token lasts one hour and a refresh token 30 days.
- Your assistant decides what it puts into a tool call. The tools tell it to send citation identifiers only, never document text, but if it sends more, we receive it. Assistants such as Claude and ChatGPT normally show you each tool call and what it sent.
What we store, and for how long
- Checks. For each check: the citations as submitted, the findings (including the case name held on the source record), the fingerprint, the label and the time. A copy of each response is kept so that a retried request returns the same answer. Checks from the Try page are kept in a separate demonstration store that is not linked to any account, and may include the citation and case name typed.
- Reports. An issued report is stored and can be opened by anyone who holds its link, which contains a 64-character hash. Do not put confidential information in a report label.
- Accounts and payments. Account records, hashed sign-in codes, usage counts, payment status and invoices.
- Where. In a database file on a persistent disk attached to our server on Render, Singapore region.
- How long. Your records (check history, saved reports, developer keys and usage) are kept until you ask us to delete them. To delete them, email info@truecite.uk from your account email address, and we delete the records stored for that account. Checks run on the Try page without an account are not linked to any account; to ask us to delete one, email info@truecite.uk with the citation you checked and the approximate date and time of the check.
What is logged
- The checking, API and connector code does not write request bodies, citations, case names or document labels to logs. It logs start-up messages and short error messages, for example when a sign-in email cannot be sent.
- Citations reach us in request bodies, not in web addresses.
- Our hosting provider, Render, keeps operational logs that may include IP addresses, times and the addresses requested.
- These pages carry no analytics, advertising or tracking scripts. Typefaces load from Google Fonts, a request your browser makes directly.
Who else sees anything
- Find Case Law, The National Archives. For each United Kingdom citation: one request for the judgment address worked out from the citation. Only when nothing is held at that address and you supplied a case name: one search request carrying one word of that name and the court. Your firm and your document are not sent. We keep a cached copy of the answer to the first request, keyed by that address; the search answer is not kept.
- Web search provider (Brave Search API). Only for a citation Find Case Law has no record of: the citation and any case name you supplied, as a search query, to locate a candidate record on approved official sites. Only the search result's details are used, and nothing is verified without a record. Treat a confidential case name sent to us as sent to a search engine.
- Australian Business Register. Only if an AI assistant uses the connector's business-number tool: the number only. A name supplied beside it is compared on our server and is not sent. These checks are not recorded.
- Revolut. The amount, the currency, a fixed description, the page to return to and our internal reference for the payment. No citations.
- Zoho Mail. Your email address, with your sign-in code or invoice.
- Render. Hosts the service and its data.
No AI model, no training
Findings come from fixed rules applied to the official record and to indexes we hold. TrueCite runs no AI model, sends nothing to an AI model provider from its servers, and trains no model on your data.
Hosting and transport
The service runs on Render in the Singapore region, so data is stored outside the United Kingdom. Plain http requests are redirected to https. The sign-in cookie, tc_session, is HttpOnly, Secure and SameSite=Lax.
What we do not claim
TrueCite holds no third-party security certification and does not claim one. This page describes what the code does today; we will update it when that changes. See also the Privacy Policy and the live coverage statement.