Sub-processors

LetterScript publishes a connector that lets an AI assistant you already use — Claude, ChatGPT, or another — read transactions on your behalf. It is off unless you turn it on. No data reaches an assistant provider until you connect it and approve specific transactions on our approval screen, and you can end that access at any time from Settings → Integrations → Connected apps, which refuses the assistant’s next call.

What the assistant can receive. From the transactions you approved, and no others: property address and parcel number, transaction record values (prices, dates, party names, roles and companies), derived deadlines, point-of-sale requirements for the parcel, document titles, and short cited excerpts of document text. The connector is read-only — it cannot send email, change a date, upload or delete a document, or move money.

Your account email address, if the assistant asks for it. An assistant may also ask which LetterScript account it is connected to. The most it can receive is a stable account identifier (a random ID, not your name) and — only if our approval screen listed Your email address and you approved — the email address you sign in with and whether we have verified it. Approval covers everything the assistant asked for, so an assistant that asks for your email address receives it only if you approve the whole request; declining means it receives nothing. We report an address as verified only after you have proven you control it: by signing in with Google, by signing in with Apple when Apple confirms the address, by completing a password reset, or by entering, on the approval screen, a code we emailed you. A password sign-up is not verified until one of those happens, and a Microsoft sign-in never counts as proof. Nothing else about your account — name, phone number, or workspace — is returned this way, and it stops when you disconnect the assistant or turn off AI assistant access for the workspace. Like any contact detail, your address can still appear inside a document excerpt a search returns.

What never leaves. Taxpayer identification numbers and wire or banking instructions are removed server-side before any result is returned. Whole documents are never readable and no download link is ever produced. Party phone numbers and email addresses are not in the party roster or the transaction record; they can still appear inside a document excerpt, because excerpt text is redacted for taxpayer identifiers and banking instructions, not for contact details.

What we record.For security and support, our service logs record every request made to the connector — each call an assistant makes, and each request it makes to sign in — with the time, the network address it came from, and the software identifier it sent (its user agent). For a call that returns an answer, they also record the tool name, which connection made it, the assistant’s host, the transaction it concerned (if any), and how much was returned. A search that runs over a transaction’s documents is recorded instead in the audit ledger of the workspace that owns the transaction, shown in that workspace’s Audit log: the time, who ran it, the tool name, the assistant’s host, the transaction, how much was returned, and what it cost. Approving or disconnecting an assistant is recorded in your workspace’s audit ledger too. Network addresses are not written to the audit ledger. We do not log your conversation, document text, or the text of your question — a search’s ledger entry keeps only a one-way hash of it. The ledger is tamper-evident and append-only, so entries are kept for as long as the workspace exists. Separately, when an assistant asks which account it is connected to, our service logs record the time, which connection asked, and the assistant’s host — never the email address itself. Those requests are not written to the audit ledger or recorded against a transaction.

After it leaves us. What the assistant provider does with data once it reaches them is governed by their terms, not ours — including whether it may be used to improve their models, which on some consumer plans depends on a setting in your account with that provider. Their current policies are the authority: Anthropic and OpenAI. LetterScript is not affiliated with, endorsed by, or partnered with either company.