We have to earn the right to see your business.
Sidecar only works if you trust it with real documents. That trust is built into the architecture: hard isolation between organizations, role-based access on every action, and a model that gives value before it asks for access.
The questions a careful operator asks.
Organization isolation
Every document, agreement, analysis, and memory lives in an org-scoped collection. Database security rules restrict reads to members of that organization — enforced at the data layer, not by convention.
Server-only writes for analyses
Agreements and their analyses can't be written from the browser at all — the rules deny client writes entirely. Every write goes through our servers, after authentication and a role check.
Files are never client-readable
Storage rules deny all direct client reads and writes of stored files. Every file access goes through the server after an organization-membership check, so no signed-in user of one org can reach another org's documents by path.
Role-based access
Owners, administrators, executives, analysts, and read-only members each see and do exactly what their role permits. Permissions are enforced on every action, server-side.
Session-cookie authentication
Sign-in issues a server-verified session cookie. There are no long-lived client tokens to leak, and sessions are validated on every request.
Your data serves you
Documents are stored in Google Firebase services and processed via the Anthropic API to produce your analysis. They are not used to train AI models, and we don't sell your data.
Provenance you can trace
Every recommendation links back to the report and the source document it came from — agreement findings cite the verbatim clause, verified against the document text.
No integrations to start
Tier 1 needs nothing connected. You upload a few documents and get value. You grant deeper access only when the results have earned it.
Wondering about the analysis itself — like whether it counts as legal advice? Straight answer here
Value first. Access later. Isolation always.
Start with one upload, in a workspace that is yours alone. Grant more only when Sidecar has shown it's worth it.