How client records are handled
Who can open a matter
The person who created it and the people they share it with, each signed in with their own email. There are no passwords; sign-in is a one-time link sent to that address. No other customer can see a matter, and nobody at Whereabouts has a sign-in that opens yours.
Whereabouts is run by one person, Ben Sage of Union Street Studios, LLC. As with any hosted service, the operator has administrative access to the underlying storage for maintenance. That access is not used to read client records.
Where records are stored
- Uploaded files, the evidence read from them, and your edits are kept in a private object store on Vercel, in the United States. Files in it have no public address and are served only through a signed-in session.
- Data is encrypted in transit and at rest.
- Nothing is stored in the browser beyond the sign-in cookie.
Who processes them
- Anthropic reads each uploaded document to extract its dated lines. Documents are sent through Anthropic’s commercial API, under terms that do not allow them to be used to train models. Anthropic may retain API inputs and outputs for a limited period for safety monitoring.
- Vercel hosts the site and the private store.
- Stripe takes payment. It receives your email and the matter’s name as the line item, and never the client’s documents.
- Resend delivers sign-in links and notifications. It receives email addresses and the matter’s name, and never the client’s documents.
If the matter name should not leave your firm, use a matter number instead of the client’s name.
Deleting
Remove a single document, or delete the whole matter from the bottom of its page. Deletion removes the uploaded files, everything read from them, and your edits from the store immediately. It cannot be undone.
What the output is
A day-by-day ledger assembled by software from the records you supplied, with each line cited to its document and page. It is corroborating evidence for counsel or a CPA to review, not legal or tax advice, and it can be wrong where the records are wrong, incomplete, or belong to someone other than the client.
Questions
Email ben@unionst.com. If your firm needs a signed data-processing agreement before uploading, ask.