We have to earn the right to see your business.
Sidecar only works if you trust it with real documents. That trust is built into the architecture: hard isolation between organizations, role-based access on every action, and a model that gives value before it asks for access.
The questions a careful operator asks.
Organization isolation
Every document, agreement, analysis, and memory lives in an org-scoped collection. Database security rules restrict reads to members of that organization — enforced at the data layer, not by convention.
Server-only writes for analyses
Agreements and their analyses can't be written from the browser at all — the rules deny client writes entirely. Every write goes through our servers, after authentication and a role check.
Files are never client-readable
Storage rules deny all direct client reads and writes of stored files. Every file access goes through the server after an organization-membership check, so no signed-in user of one org can reach another org's documents by path.
Role-based access
Owners, administrators, executives, analysts, and read-only members each see and do exactly what their role permits. Permissions are enforced on every action, server-side.
Session-cookie authentication
Sign-in issues a server-verified session cookie. There are no long-lived client tokens to leak, and sessions are validated on every request.
Your data serves you
Documents are stored in Google Firebase services and processed via the Anthropic API to produce your analysis. They are not used to train AI models, and we don't sell your data.
Provenance you can trace
Every recommendation links back to the report and the source document it came from — agreement findings cite the verbatim clause, verified against the document text.
No integrations to start
Tier 1 needs nothing connected. You upload a few documents and get value. You grant deeper access only when the results have earned it.
Wondering about the analysis itself — like whether it counts as legal advice? Straight answer here
Where your documents go, and how they leave.
Who you're actually trusting
Sidecar is a product and service owned and operated by Built By Signal LLC, Ohio limited liability company and a venture-building company operating under the SIGNAL brand. Built By Signal LLC is the entity that holds your data, signs your agreement, and carries the commitments on this page — "Sidecar" is the brand it operates under, not a separate company.
Who else touches your documents
Two subprocessors, both named: Google Cloud (Firebase) stores your documents and data, and Anthropic's API performs the analysis. Email notifications go out through Google Workspace. That's the whole list — no data brokers, no advertising networks, no analytics vendor ever sees a contract.
Whether your contracts train an AI model
They don't. Sidecar sends your document to the Anthropic API to produce your analysis, and API inputs are not used to train models. Your agreements are not used to improve Sidecar for anyone else either — the only thing your documents inform is your own workspace's business memory.
Encryption
Documents and data are encrypted in transit (TLS) and at rest, by the Google Cloud services that hold them. Files are never readable directly by a browser: storage rules deny all client access, so every download passes through our servers after an organization-membership check.
Deleting things
You can delete any agreement from your workspace at any time. Deleting an agreement removes its analyses and, when the file was uploaded through agreement intake, the stored file itself — not just a hidden flag. If you want the entire workspace and everything in it removed, ask and we'll delete it.
Who at Sidecar can see your reports
Reports are held for a quality review before release, so a Sidecar reviewer reads the analysis of your agreement — that human check is how findings stay tied to your actual clauses. Access is limited to the platform administrators who run that review, and administrative actions are written to an append-only audit log.
What we are not
Sidecar is business decision support, not legal advice, and not a law firm — no attorney-client privilege attaches to what you upload. For agreements where that privilege matters, a review packet is built to forward straight to your attorney.
Need this in a form your counsel can sign off on — a DPA, a security questionnaire, a specific retention window? Ask us
Value first. Access later. Isolation always.
Start with one upload, in a workspace that is yours alone. Grant more only when Sidecar has shown it's worth it.