We have to earn the right to see your business.
Sidecar only works if you trust it with real documents. That trust is built into the architecture: hard isolation between organizations, role-based access on every action, and a model that gives value before it asks for access.
The questions a careful operator asks.
Organization isolation
Every document, agreement, analysis, and memory lives in an org-scoped collection. Database security rules restrict reads to members of that organization — enforced at the data layer, not by convention.
Server-only writes for analyses
Agreements and their analyses can't be written from the browser at all — the rules deny client writes entirely. Every write goes through our servers, after authentication and a role check.
Files are never client-readable
Storage rules deny all direct client reads and writes of stored files. Every file access goes through the server after an organization-membership check, so no signed-in user of one org can reach another org's documents by path.
Role-based access
Owners, administrators, executives, analysts, read-only members, and external guests — outside counsel, a fractional CFO — each see and do exactly what their role permits. Permissions are enforced on every action, server-side.
Session-cookie authentication
Sign-in issues a server-verified session cookie. There are no long-lived client tokens to leak, and sessions are validated on every request.
Your data serves you
Documents are stored in Google Firebase services and processed via the Anthropic API to produce your analysis. They are not used to train AI models, and we don't sell your data.
Provenance you can trace
Every recommendation links back to the report and the source document it came from — agreement findings cite the verbatim clause, verified against the document text.
No integrations to start
The first rung needs nothing connected. You upload a few documents and get value. You grant deeper access only when the results have earned it.
Wondering about the analysis itself — like whether it counts as legal or financial advice? Straight answer here
Where your documents go, and how they leave.
Who you're actually trusting
Sidecar is a product and service owned and operated by Built By Signal LLC, Ohio limited liability company and a venture-building company operating under the SIGNAL brand. Built By Signal LLC is the entity that holds your data, signs your agreement, and carries the commitments on this page — "Sidecar" is the brand it operates under, not a separate company.
Who else touches your documents
The same list as our privacy policy, all named: Google Cloud (Firebase) stores your documents and data, and Anthropic's API performs the analysis. Notification and account email goes out through Google Workspace, with Resend configured as a backup sender. Stripe takes card payments where they're offered — card details go to Stripe, never to us. Google Analytics measures page visits and never receives a document. An AI assistant you connect yourself gets what it requests, under your agreement with its provider. No data brokers, no advertising networks.
Whether your contracts train an AI model
They don't. Sidecar sends your document to the Anthropic API to produce your analysis, and API inputs are not used to train models.
Connecting your own AI
Where AI connectors are switched on for your workspace, you can connect Claude, ChatGPT, or your own agent to it. It reads what Sidecar has reviewed and can suggest; it cannot act, and nothing it suggests takes effect until a person accepts it. What your assistant requests is sent to that assistant's provider under your agreement with them — our no-training commitment covers the processors Sidecar chooses, not the ones you connect. Every connection, every scope, and every call is listed under Insights → AI connectors, where any workspace manager can revoke it.
What we learn across customers, exactly
One anonymized record per completed review, describing the SHAPE of the agreement: its type, term length, whether it auto-renewed, the notice window in days, how price increases and liability were handled, and how many red flags it had. That record carries no organization, no vendor or counterparty name, no dollar figures, no dates, and no text from your document — it cannot be traced back to you or to who you signed with. It exists so that, once at least 30 agreements of a type have been seen, a review can tell you whether a term is unusual ("a longer notice window than most agreements of this type we've seen") instead of leaving you to guess. Until then a review makes no such comparison. Nothing else crosses between workspaces.
Encryption
Documents and data are encrypted in transit (TLS) and at rest, by the Google Cloud services that hold them. Files are never readable directly by a browser: storage rules deny all client access, so every download passes through our servers after an organization-membership check.
Deleting things
You can delete any agreement from your workspace at any time. Deleting an agreement removes its analyses and, when the file was uploaded through agreement intake, the stored file itself — not just a hidden flag. If you want the entire workspace and everything in it removed, ask and we'll delete it.
Who at Sidecar can see your reports
A Sidecar reviewer reads a document and its analysis when you request a Sidecar review of that report, or when a support case or a quality check needs it. Access is limited to the platform administrators who do that work, under the same limits either way, and administrative actions are written to an append-only audit log.
What we are not
Sidecar is business decision support, not legal advice, and not a law firm — no attorney-client privilege attaches to what you upload. It is not financial, tax, or accounting advice either: savings ranges and pricing figures are estimates, not an audit or a valuation. For agreements where privilege matters, a review packet is built to forward straight to your attorney.
Need this in a form your counsel can sign off on — a DPA, a security questionnaire, a specific retention window? Ask us
Value first. Access later. Isolation always.
Start with one upload, in a workspace that is yours alone. Grant more only when Sidecar has shown it's worth it.