Security
No background capture, no training on your text, and no write access to your docs. This page explains what Rewrait processes, when processing happens, and which providers are involved.
Rewrait sends text for processing only when someone selects text or dictates a draft, then triggers a shortcut. There is no always-on monitoring, no background capture, and no keystroke logging. If nobody presses Cmd/Ctrl+Shift+P, nothing leaves the machine.
Submitted text is processed to return your rewrite and is not used to train Rewrait's models or any third-party model. Team plans put that in writing: a no-training guarantee with a DPA.
Rewrait does not store your rewrites unless a user explicitly opts in to history. If history is on, items can be deleted one at a time. Feedback events (thumbs up or down on a rewrite) never store the text itself.
Integration OAuth tokens are stored AES-encrypted, and every integration requests read-only scopes. Rewrait can read approved content from Notion, Confluence, or Google Docs, but it cannot edit, move, or delete anything in those services.
Connecting an integration does not give shortcuts access to every source. The workspace owner whitelists the specific Notion, Confluence, and Google Docs sources that shortcuts may read. Nothing outside that list is ever fetched.
Each approved source is fetched read-only, cached, and capped at 12,000 characters. Rewrait does not bulk-export your knowledge base.
AI providers receive text only at the moment a rewrite or dictation runs; payment and email providers never see your content at all. These are the subprocessors used by Rewrait's production stack.
| Subprocessor | Purpose |
|---|---|
| OpenAI | Rewrite processing, only when a shortcut runs |
| Google (Gemini) | Rewrite processing, only when a shortcut runs |
| Deepgram | Dictation transcription, only while you dictate |
| Stripe | Payment processing. Never sees your text. |
| Brevo | Transactional email. Never sees your text. |
| Fly.io | Application hosting and managed Postgres database |
SOC 2 is on our roadmap and not yet certified. If your security review needs specifics today, ask us. We will answer directly.
Send security questions, vulnerability reports, and review questionnaires to this address. A founder will respond directly.
[email protected]FAQ
No. Text you submit is processed to return the rewrite and is not used to train Rewrait's models or any third-party model. On Team plans this is contractual: a written no-training guarantee plus a DPA. Rewrait limits when text is received and retained. It receives text only when a user selects text or dictates a draft and triggers a shortcut. It does not continuously collect your company's writing. Rewrite history is off by default, meaning even your own past rewrites are not retained unless you opt in, and feedback events never store text. The AI subprocessors that perform rewrites (OpenAI and Google Gemini) see only the text of the specific request, plus whatever approved source context the shortcut is configured to read.
It comes back to you and, by default, that is the end of it. Your selected text and the shortcut's approved context go to the AI provider. The provider returns the rewrite, and Rewrait replaces the selected text in your app. Rewrait does not store the text unless you have turned on rewrite history, which is off by default. If you enable history, every item can be deleted individually, and turning history off again stops new items from being saved. Thumbs-up and thumbs-down feedback is recorded as an event without the underlying text. Voice dictation works the same way: audio is transcribed by Deepgram at the moment you dictate, and the transcript follows the same rules as typed text.
No. All three integrations request read-only OAuth scopes, so Rewrait is technically unable to write, move, or delete anything in your docs. The permission is never granted, not merely unused. The workspace owner approves a whitelist of specific sources, and shortcuts can read only pages on that list. Each source is fetched read-only, cached to limit repeat fetches, and capped at 12,000 characters. Rewrait does not sync the full knowledge base. OAuth tokens for these connections are stored AES-encrypted, and the owner can disconnect an integration at any time, which severs access immediately. If your security review needs the exact scope strings we request from each provider, email [email protected] and we will send them.
Not yet. SOC 2 certification is on our roadmap. Today, Rewrait offers the commitments documented on this page: on-demand processing, no training on your text, history off by default, and read-only integrations with encrypted OAuth tokens. Team plans include a DPA and written no-training guarantee. Rewrait is a small company and does not yet have SOC 2 certification, but a founder responds directly to security questionnaires. If your procurement process requires a SOC 2 report before purchase, email [email protected]. We will tell you whether our certification timeline fits yours.
Rewrait stores account data, workspace configuration, and limited content under the conditions below. Account data: names, emails, credentials or OAuth identities, workspace membership, and billing records. Card details live with Stripe, never with us. Configuration: your styles, shortcuts, workflows, the approved source whitelist, and AES-encrypted OAuth tokens for connected integrations. Rewrite content: none by default. Rewrite history is opt-in per user and deletable item by item; feedback events store no text; cached copies of approved sources are capped at 12,000 characters and fetched read-only. The application and its Postgres database run on Fly.io, and the workspace owner can disconnect any integration at any time, which cuts off source access immediately. If your review needs this as a formal data inventory, or you have a questionnaire in your own format, email [email protected]. A founder fills it in directly.
Rewrite history is off by default, approved sources are read-only, and text is sent only when you trigger a rewrite or dictation. Start the 14-day free Team trial and audit the settings on day one.