A liability-bearing product, built like one.
Civic Scrub handles government records and the personal information inside them. Every design decision assumes the system is exposed and the stakes are a lawsuit.
US-only data residency
Documents live in US-only Cloudflare R2 buckets. Nothing leaves the country.
Encrypted at rest and in transit
SSE-S3 encryption on stored blobs, TLS 1.2+ on every request.
Per-tenant isolation
Every query and mutation gates on your organization id. Cross-agency access throws — structurally, not by convention.
PII is kept out of the LLM and logs
The AI classifier is pre-tokenized — it never sees raw PII — and payloads are scrubbed before log writes.
Burn-in, not overlay
Approved redactions are rasterized into the PDF. The text underneath is destroyed, not hidden.
Append-only audit log
Every detection, proposal, and clerk decision is written to a per-agency, append-only log — the chain-of-custody record a public-records defense needs. Cryptographic hash-chaining is on the roadmap.
Human in the loop
The clerk is always the final reviewer. Nothing releases without a person approving it.
Abuse & cost guards
Rate limiting on auth, plus a hard per-document AI budget so a bad actor cannot run up the bill.
Where we are, honestly.
We do not claim certifications we do not hold. Current status:
Running a formal security review? Get in touch — we’ll walk you through the architecture and answer your questionnaire.