Data Handling & Security
Last updated: 7 August 2026
This page is for the person at an expedition company who has to decide whether twenty years of post-voyage reports and site-guide binders can be handed to a piece of software. It sets out what happens to those documents, who else touches them, where they go, how long anyone keeps them, and what is not yet in place. It is deliberately specific, including where the answer is inconvenient.
Where the product currently stands. Cairnbase is at v0.5 and runs locally on a single machine against a local database file. There is no hosted multi-tenant service, no customer accounts, and no paying customers yet. Everything below that describes the hosted service is a statement of what the service will do and what early-access customers will be offered — not a description of a system already running in production. Where something is a commitment rather than a completed fact, this page says so.
This is a working draft, published for buyers to read and question. It has not been reviewed by a solicitor, and it will be before it forms part of any customer agreement.
What we do with your documents
You upload documents — post-voyage reports, site guides, briefing sheets, binder pages, scans. The uploaded file is stored as you sent it. Text is extracted from it, and for PDFs the pages themselves are also read as images so that hand-written margin notes, sketch maps and tables are not lost.
That content is then sent to Anthropic's Claude API to be read and turned into structured records: a site, a position, a date, a visit, an activity, a hazard, a guideline. This is the only place your document content leaves our systems, and it is covered in detail two sections down.
What comes back is a draft, not an entry. The parser is instructed to flag its own uncertainty rather than guess — an inferred date, a fuzzy site name, a missing position — and a member of your staff reviews every extraction and confirms or corrects it before anything is written into your catalogue. Nothing reaches the catalogue on the strength of the AI alone. This matters because AI parsing can misread a document, and because the content here includes hazard information that people act on.
Records are separated by company. Every site, visit, document and fact in the system belongs to exactly one company workspace, and the hosted service will enforce that boundary at the query layer. Guides keep their own personal field records; what is contributed to a company workspace stays with the company. Which tier a record lands in is decided by the account that uploads it, never by whose name appears inside the document — section 9 of the terms sets out that rule and why it matters.
Who else sees them
Three companies sit behind Cairnbase today. They are listed in full below, with what each one does and where it does it. Nobody else has access to your documents, and we do not sell, rent, or share your content with anyone for any purpose of our own.
That leaves the question people ask us second, which is what we do with them. Someone here opens your documents to run the service, fix a fault, or answer something you have asked about, and not to browse. What we learn from your material does not go into another operator's briefing or into our own expedition work — the people building Cairnbase also work in the field, so that is worth saying out loud rather than leaving to be assumed. Section 5 of the terms puts it in contract language and sets out the limits of it.
| Who | What they do | Where |
|---|---|---|
| Anthropic PBC | Reads uploaded documents and returns structured extractions (the Claude API). | United States, or Anthropic's global inference infrastructure. There is no EU option — see below. |
| Cloudflare | Hosts the cairnbase.ai website, provides DNS, and routes email sent to hello@cairnbase.ai. | Cloudflare's global network. |
| Provides the mailbox that receives hello@cairnbase.ai, including anything you send us by email. | Google's infrastructure. |
There is no hosting provider for customer data on this list because there is no hosted service yet. When one is chosen it will be added here before any customer data reaches it.
We will keep this list current, and we will tell customers before a new subprocessor is added — not after.
Where your documents physically go
This has two answers, and they are different. Read both.
Storage. Where the workspace database and your uploaded files live is a choice we control, and we intend to make it in the EU. That is an intention, not a description: there is no hosted service and no production infrastructure today. When there is, this page will name the region and the terms will carry it as a commitment. Wherever you see us say we intend to host in the EU, read it as being about storage. It has never covered parsing.
Parsing. Where a document is read is not a choice we control. Anthropic's API lets a request specify inference in the United States or on its global infrastructure. As of today there is no EU inference option, and storage on Anthropic's side is in the United States. So document content leaves the EU while it is being parsed. We cannot promise otherwise, and we would rather you had that in writing than discovered it in due diligence.
For an EU customer this means the parsing step is an international transfer of whatever personal data your documents contain — guide names, expedition leader names, incident accounts — and needs an appropriate safeguard, typically standard contractual clauses. This is the ordinary position for European software that uses AI rather than an unusual one. Our commitments: we will execute a data processing agreement with Anthropic covering this transfer, and we will offer a data processing agreement to customers. Neither is signed yet.
It also means the less of that content you send us, the smaller the question. Section 14 of the terms asks you to redact a guest's name and any clinical detail where you reasonably can before uploading, and not to upload files whose subject is a person at all. It is a request rather than a rule you could breach by importing your archive, because an incident entry in a post-voyage report will sometimes describe a guest and we are not going to pretend otherwise.
How long anyone keeps them
Cairnbase. Your uploaded files and the records built from them stay in your workspace until you delete them or until your agreement with us ends. We do not silently expire your material; the whole point of the product is that the 2027 visit is still there in 2033.
Anthropic. This depends on which of two paths a document takes, and the path is chosen at the point of upload by the person uploading. That is worth understanding before an archive import.
- The batch path retains your documents for 29 days. It uses Anthropic's Batch API, which is not eligible for zero data retention; Anthropic holds a batched request for 29 days before it ages out. We recommend this path at three or more documents because it costs about half as much, but the recommendation is only a highlighted button. The upload screen offers "Queue as a batch" and "Parse now" side by side, and either will take an upload of any size. A single incident report queued as a batch sits in Anthropic's batch storage for 29 days; a hundred binder pages parsed interactively never go near it. The file count does not decide this — whoever presses the button does. This is the single most important retention fact on this page.
- The interactive path uses the Messages API, which is eligible for zero data retention. Zero data retention is granted by Anthropic per organisation on request, and we have not requested or obtained it. We intend to pursue it. Until we have it and can say so here with a date, assume this path carries Anthropic's standard retention.
- Flagged content is the exception to all of the above. Content that Anthropic's automated trust and safety systems flag may be retained for up to two years regardless of any other arrangement, including zero data retention. We have no control over this and cannot contract it away.
We will update this section when the zero-retention position changes, and we will date the change.
Is our material used to train anyone's AI
No. Anthropic commits that data retained through the API is not used to train their models without express permission. We have given no such permission and will not. We do not train models on your content ourselves, and we do not pool one company's material into anything another company can see.
Cairnbase is designed around three tiers: a guide's personal records, a company's workspace, and a shared industry layer. The industry layer does not exist yet, and when it does, nothing will move into it without the consent of whoever owns the record. Section 9 of the terms sets out all three.
What happens when you leave
Full export of your workspace, in a usable open format, at any time and without asking us first. No export fee, no exit fee, no notice period before you are allowed to take your own material out. Tracks come out as GPX, records as structured data, and your original uploaded files come out as the files you uploaded.
The export tooling is on the build list for the hosted service and is not finished in v0.5. Until it is, this is a commitment we will honour manually for any early-access customer who asks.
When the relationship ends, your content stays available for export for a set window, and is then deleted from live systems and from backups as those rotate. Section 15 of the terms holds the actual periods. Ask for deletion sooner than that and we will do it and confirm when it is done. Anything already sitting in a subprocessor's retention window ages out on that subprocessor's clock, not ours.
Cairnbase is a knowledge record, not an authority
Cairnbase holds hazard information: which anchorage holds in a southerly, where the crevasse field is, which landing goes away on a falling tide, what the bear did in 2019. That is exactly what makes it valuable and exactly why it must not be treated as a chart, a pilot, a permit, or a regulator. It records what your people wrote down. It is not a navigational, safety, or regulatory-compliance authority, and it must not be the sole basis for a safety-critical decision. The master and the expedition leader retain command responsibility, always. Section 6 of the terms puts that in contract language, and it is the most important section in the document.
Security, as it honestly stands
What is in place today:
- Company workspace separation is built into the data model. Every site, visit, document, fact and import belongs to a named company.
- A human review-and-confirm step between AI extraction and the catalogue, so no machine-read claim becomes company record unreviewed.
- Uploaded filenames never reach the filesystem. Files are stored under paths the system rebuilds from a whitelist of permitted extensions, which closes off a whole family of upload attacks.
- Traffic to the Claude API and to the website is encrypted in transit.
- The marketing site has no accounts and no cookies. Its only measurement is Cloudflare Web Analytics, which counts page views without setting a cookie, storing anything on the visitor's device, or following anyone to another site. It carries one early-access form, and what that form collects goes to a database on our own Cloudflare account and nowhere else — no third-party form service, no mailing-list platform, no CRM. The privacy policy is the authority on what is collected and how long it is kept.
What is not in place, stated plainly because you would find out anyway:
- No third-party certification of any kind. No SOC 2, no ISO 27001, no independent audit. If a tender requires one, we do not qualify for it today.
- No penetration test has been carried out.
- No data processing agreement is executed with Anthropic yet, and none is yet offered to customers. Both are committed.
- No zero-data-retention arrangement with Anthropic.
- No production hosting, and therefore no claims here about encryption at rest, backup schedules, access logging, or key management. Those statements will be written when there is real infrastructure to describe, not before.
- No documented incident-response procedure and no contractual breach-notification window yet. Both belong in the customer agreement and are not written.
- No named data protection officer.
A buyer should weigh that list. It is the position of a pre-launch product, and it will shorten. If a gap on it is a blocker for you, say so — knowing which ones block real customers is how they get prioritised.
Who to call
Email hello@cairnbase.ai. That address reaches a person, not a queue. Use it for a security concern, a data-protection question, a request to see or delete what we hold, or to tell us that material belonging to you was uploaded to Cairnbase by someone without the right to upload it — we will look into that and take it down where the claim holds up.
The company behind Cairnbase is Cairnbase, Inc., a Delaware corporation incorporated on 3 August 2026. Section 1 of the terms carries the details, and section 21 there says which values are settled facts and which are provisional positions awaiting solicitor review.
Changes to this page
When any of the above changes — a new subprocessor, a hosting region confirmed, a zero-retention arrangement obtained, a certification actually achieved — this page is updated and the date at the top changes with it. Where a change matters to a customer, we will tell them rather than wait for them to notice.