Privacy is not a setting. It is the shape of the space.
Create visibility zones inside your Workspaces — even inside a single document. Control who sees what, down to the sentence.
Create visibility zones inside your Workspaces — even inside a single document. Control who sees what, down to the sentence.
In most platforms, sharing is all-or-nothing. You share a document, and everything inside is visible. Draftbox lets you create visibility zones within Workspace Sections — areas that only specific people can see. A team member might see the analysis but not the raw data. A collaborator might see the conclusion but not the draft that led to it. The same document, different worlds.
Full visibility
Sees everything in the section
Restricted zone
Sees only what is explicitly shared
Confidential block
Invisible to everyone except the author
Select any part of your text. Mark it as confidential. It becomes invisible to collaborators, to AI processing, to external APIs. The words stay in your document — but they travel nowhere you do not send them.
You see the masked text in your editor. It is your words. You wrote them. You control them.
Masked sections are stripped before any AI call. The model never sees them. They do not enter the RAG pipeline. They cannot leak through responses.
Collaborators see a placeholder where the text was. They know something is there. They cannot read it. Permission is yours to grant, not theirs to take.
Names, emails, phone numbers
Credit cards, bank accounts, IBANs
National IDs, passport numbers, tax IDs
API keys, tokens, passwords
IP addresses, URLs with credentials
Dates of birth, home addresses
In the air-gapped deployment mode, none of it leaves your infrastructure — every AI call, embedding and rerank runs on your own models. On the roadmap: a mask tool to mark any part of a document as confidential, delivered to the AI as [CONFIDENTIAL].
Your data is not training material. Your thoughts are not a product. What you think here stays here.
GDPR isn't a checkbox. It's a commitment. You can access, correct, export, restrict, or delete your data — at any time, no questions asked.
Right to access & port
Export everything you've ever created in a structured, machine-readable format. Your data is portable — it goes where you go.
Right to be forgotten
Request complete erasure of your data. The system processes deletion requests within mandated timeframes — no retention beyond what the law requires.
Right to rectify & restrict
Correct inaccurate data or restrict processing at any time. You decide how your information is used — not the platform.
Every data request is tracked from submission to completion, with automated workflows ensuring GDPR-mandated response timeframes are met. Request history is retained for audit compliance — so regulators can verify, and you can trust.
Content is automatically classified by sensitivity — from public information to restricted material requiring special handling. This classification drives access controls, encryption policies, and retention rules. Nothing is left unclassified. Nothing is treated the same.
Public
Freely shareable, no restrictions
Internal
Organization-wide, not external
Confidential
Need-to-know, access controlled
Restricted
Highest sensitivity, logged access
Retention with purpose
Data is retained only as long as legally required and no longer. Security audit logs are kept for 7 years to meet compliance obligations. Data subject records are purged automatically once retention periods expire — the system cleans up after itself.
Automated enforcement
Retention policies aren't just documented — they're enforced. Daily automated processes classify unclassified data and purge expired records. And the purge itself is logged, so auditors can verify compliance.