Infrastructure
Separate QA runtime; production launch verification still pending
Skip to main content
Trust and data handling
Current facts, including the gaps.
This page gives buyers and technical reviewers a codebase-grounded view of AnswerLattice infrastructure, providers, retention, and current compliance claims. It is operational documentation, not a certification or contract.
AnswerLattice is operated by Neelvara Systems, an India-based business. Last reviewed: September 6, 2026.
Official answers
Reviewed before users receive support guidance
Disclosure
No unsupported certification, DPA, or residency claim
Operational provider map
Who supports the current service
These are the active or configurable provider categories visible in the AnswerLattice runtime. Contractual terms and geographic processing requirements still need buyer-specific review.
AreaProviderPurposeData boundary
Area
Application hosting and domains
Provider
Vercel
Purpose
Serves the AnswerLattice Next.js application and manages configured public and hosted-help domains.
Data boundary
Application requests and deployment metadata required to serve the product.
Area
Database, authentication, storage, and functions
Provider
Google Firebase and Google Cloud
Purpose
Stores workspace data, authenticates product access, holds scoped files and compiled context, and runs AnswerLattice Cloud Functions.
Data boundary
QA uses the separate AnswerLattice Firebase project. The separately defined production target still requires deployment and launch certification.
Area
AI-assisted processing
Provider
Google Gemini
Purpose
Supports configured drafting, extraction, embedding, fallback, and review-assistance paths.
Data boundary
Generated output remains draft or fallback material until the applicable review path approves it as official support.
Area
Billing
Provider
Razorpay
Purpose
Creates checkout, subscription, and top-up provider records.
Data boundary
AnswerLattice stores bounded billing identifiers, status, amount, currency, and lifecycle summaries, not payment-card details.
Area
Email delivery
Provider
Configured SMTP service
Purpose
Sends selected support and workflow notifications when email delivery is configured.
Data boundary
Delivery uses the intended recipient, subject, bounded message content, and compact delivery diagnostics.
Area
Cache and rate limiting
Provider
Upstash Redis when configured
Purpose
Supports bounded cache and public-request rate-limit paths.
Data boundary
The durable workspace source of truth remains in AnswerLattice Firebase.
Area
Public website analytics
Provider
Plausible and Google Analytics when configured
Purpose
Measures public website activity only after analytics consent.
Data boundary
The public website stays on essential behavior when analytics is declined or no measurement setting is configured.
Implemented retention
Bounded windows for raw operational data
These windows describe implemented product retention controls. Durable workspace truth, approved knowledge, billing state, and extracted source text have different lifecycle requirements.
Query embedding cache
30 days
Temporary retrieval cache with expiry and cleanup.
Raw answer and search history
90 days
Bounded runtime trace used for feedback, support gaps, and troubleshooting.
Scheduler and notification delivery logs
90 days
Compact operational and delivery diagnostics.
Notification rate-limit counters
2 days
Short-lived abuse and delivery-volume counters.
Public contact enquiries
365 days
Buyer or support follow-up records with an expiry field.
Signal events
365 days
Scheduler cleanup bounds the raw signal window.
Friction daily statistics
90 days
Compact historical product-friction measurements.
Knowledge Intake raw media
Not retained after extraction
Extracted, redacted source text and review lineage remain until removed or a later lifecycle policy applies.
Claim status
What is not being claimed
Security controls and product separation are evidence. They do not automatically create an audit certification, legal agreement, or residency commitment.
Independent security certification
No ISO 27001 certification or SOC 2 Type II report
Business registration and provider certifications do not certify AnswerLattice. Our documented product controls are not an independent audit or a guarantee of compliance with privacy law.
Data Processing Agreement
Not published as a standard public document
A standard DPA is not currently available. Where a data-processing agreement is required, the applicable terms must be agreed before that processing begins. Do not submit customer personal data for such use until the review is complete.
Contractual subprocessor schedule
Not published
The operational provider map on this page is factual product documentation, not a contractual subprocessor schedule.
Data residency commitment
No public residency promise
If a specific processing or storage region is mandatory, it must be confirmed as a contractual deployment requirement before purchase.
AI-provider training and zero retention
No public no-training or zero-retention claim
Those claims depend on the active Gemini billing tier, feature use, abuse-monitoring status, and account configuration. They must be verified against the deployed provider account before purchase or publication.
Full workspace deletion
Handled through a scoped support review
AnswerLattice does not claim a one-click full-workspace deletion flow. Contact the team to confirm scope, billing state, legal constraints, and deletion evidence.
For data-processing agreement questions, contact legal@neelvara.com. This information is not a DPA or a contractual subprocessor schedule.
Report a security issue
Send the affected URL, a brief description, and safe reproduction steps to security@neelvara.com. Do not include secrets or customer records. This contact does not authorize scanning, accessing other workspaces, or disruptive testing.
Report content abuse
For suspected impersonation, unlawful content, or rights infringement on an AnswerLattice hosted page, send the public URL and a short explanation to hello@answerlattice.com. Avoid sending private support conversations or sensitive attachments. Reports require review; sending a report does not guarantee removal.
Run a buyer security review
Share your required controls, processing regions, legal terms, deletion expectations, and rollout scope before purchase. Requirements that are not documented here are not assumed to be available.
Request security review