PUBLIC BETA · OCTOBER 2026

Your records
stay yours.

What is stored

AWS Cognito stores your email, password credentials and email-verification state in Singapore. LastCopy stores a pseudonymous account identifier, hashed session tokens, private imported files and saved reports on its AWS server in Singapore. Sessions expire after eight hours. Passwords and provider tokens are not returned to the browser.

Scope and retention

This is an early beta. Keep your own originals. Do not upload sensitive respondent information while independent security review, full disaster recovery and self-service account/data deletion remain incomplete. Files and reports remain until a reviewed removal. In Your data, verified accounts can export their registered originals/reports and submit an authenticated erasure-review request. A request does not erase data or close the account automatically. The proposed 30-day backup expiry is prepared but inactive.

Backups

Encrypted database backups run daily on the existing host. An off-host copy was decrypted and its evidence hashes were checked; a separate Central database restore was also tested. This is not a full machine restore. Daily encrypted S3 replication was activated and its fresh ciphertext readback verified on 26 October 2026. Recovery of Web Form links and full-machine configuration remain incomplete. Backup copies are retained without automatic deletion.

AI and demo data

The public example uses synthetic files and calls no AI or external provider. Connected investigation currently permits explicitly synthetic test evidence only. New public accounts do not inherit owner credentials or sponsor connections.

Account recovery

Verification and password-reset codes are sent through AWS’s built-in email service. Its shared daily limit can delay delivery. Password reset revokes existing LastCopy account sessions. Resend is not configured because a verified sending domain is not yet available.