Your agency’s work
stays yours.

Your documents, your data

• Your data is used to provide, secure, support, troubleshoot, maintain, and improve Royalty Reader, subject to your contract and the law.
• Your data is not used to train, retrain, or fine-tune AI models.
• Your data is not made available to other agencies, and each agency’s data is kept separate.
• Documents processed by AI or automation are treated as your data.
• Development and demo environments use synthetic documents, never your production data.

Robust access control

• Your accounts require multi-factor authentication.
• Company systems, source code, and production infrastructure require multi-factor authentication as well.
• Access is granted by role and business need, and reviewed at least quarterly.
• Access is removed within 24 hours when someone leaves or no longer needs it.

Resilient platform and recovery

Independently tested

Royalty Reader maintains a commitment to being assessed by third parties. Our 2026 penetration test was conducted by Cobalt, an independent penetration testing company. The final report showed no critical, high, or moderate findings.

Request the report here.

Dedicated security program

A designated security and privacy lead runs the program. Leadership reviews risks, vendors, incidents, and program progress at least quarterly.

The program is documented, aligned to the NIST Cybersecurity Framework, and covers:

• Access control
• Vulnerability management
• Secure development
• Vendor review
• Incident response
• Privacy

• Everyone with access to company systems or your data completes security training at onboarding and at least once a year after that.
• Production code changes are peer reviewed before release.
• Dependencies are scanned for known vulnerabilities.
• Vendors that store or process your data are reviewed before they are used.