Where your documents go

Plain-English data handling for The Lull. Updated June 2026. Questions: email us.

Storage

Uploaded offering memorandums and deal files are stored in a private Supabase storage bucket in the United States. Files are uploaded directly from your browser over TLS to a path that begins with your account id; nothing is written to shared or public locations.

Who can see your deals

Every deal row and file is protected by row-level security: your account (and, if your firm uses a team workspace, members of your firm’s group) can read your deals — other customers cannot, at the database layer, not just the UI. There is no cross-firm sharing of deals, comps you upload, or generated documents.

What touches the AI

When you upload an OM, the PDF is sent to Anthropic’s Claude API to extract the deal’s facts, and later to draft memo prose. Anthropic’s API terms govern that processing; The Lull does not use your documents to train models. Deterministic calculations (NOI, DCF, debt metrics) run in our own code, not in the model.

Retention and deletion

Deals and files persist until you delete them. Deleting a deal removes its row and files. If you want your account’s data fully removed, email us and we delete it, including storage objects.

The verification corpus (please read this one)

The Lull’s correctness is enforced by a regression corpus: real deals whose numbers every code change must reproduce before it ships. When you flag a wrong number in the app, we may ask to enroll that deal in the corpus. Enrollment only happens with your explicit per-deal consent, recorded on the flag. Corpus copies live in a separate private bucket accessible to The Lull’s operator (not to other customers), and exist solely to keep the math honest. You can withdraw a deal at any time: we delete the corpus copy, and keep a derived test assertion only if it can be expressed without your document.

What this page is not

This is honest documentation, not a compliance certification — The Lull does not yet hold a SOC 2 attestation. If your diligence process needs specifics beyond this page (subprocessor list, data-flow diagram, DPA), ask and we will provide them.