Patent Bear insideClaude,ChatGPT and Codex,and Gemini.

Search, Research, Draft, and Library, as tool calls in your agent. Listed in the Claude connector directory. Connect now

Research

Analyses
All of Research

Draft

From the record
All drafts, including what is in build

Library

Yours, private
Open the Library
Security at Patent Bear

Quiet, audited, unshared.

Your patent research is sensitive. Here’s exactly how we protect it. No marketing, just the stack.

Last reviewed: September 29, 2026

Working on privileged client matters? Read Confidentiality & Privilege →

SOC 2 / ISO
Provider controls
AES-256
Encryption at rest
TLS 1.2+
Encryption in transit
Transient
Worker processing
  1. 01

    Compliance posture

    Reviewed September 2026
    Audited core providers
    Our core application, database, payment, object-storage/CDN, and AI providers publish independent security and compliance programs such as SOC 2 Type II, PCI DSS Level 1, ISO 27001, or equivalent attestations depending on provider and service.
    Private, single-tenant processing workers
    Some Research, OCR, column-line, search, ranking, and analysis tasks run through Patent Bear's own private, single-tenant worker services, not a shared multi-tenant pool. Jobs are keyed by an anonymous account identifier. They are transient compute: they process a job in memory over encrypted connections, return results to Patent Bear's durable systems, and are not a place where user work product is stored.
  2. 02

    Infrastructure

    Database
    All user data (annotations, saved patents, search history, chat, runs, and drafts) is stored with our database provider, Supabase, which holds a SOC 2 Type II report, and is protected by row-level security policies. Data is encrypted at rest with AES-256; connections use TLS 1.2+.
    Hosting
    Hosted on Vercel, with automatic DDoS mitigation, edge caching, and a global CDN. Vercel holds a SOC 2 Type II report and supports GDPR compliance. HTTPS only.
    File storage
    Patent figure images live on Cloudflare R2, whose SOC 2 Type II report and ISO 27001 certification belong to Cloudflare, served through a global CDN. AES-256-GCM at rest, TLS 1.2+ in transit.
    Research workers
    Research jobs may run through isolated worker services for search, ranking, OCR, column-line generation, and AI analysis. The worker layer is designed so user data is transient in memory or temporary job context only; Patent Bear does not intentionally persist user prompts, patent excerpts, uploaded inputs, generated analysis, or work product to worker disk. Durable run state, outputs, and files are written back to our database and object storage, which are the systems of record.
  3. 03

    Encryption

    In transit
    All data between your browser and Patent Bear is encrypted with TLS 1.2+. Every API call, auth request, data transfer, and figure load. No unencrypted connections anywhere.
    At rest
    User data is encrypted at rest with AES-256, the same standard used by financial institutions. Applies to saved patents, annotations, highlights, notes, search history, and chats.
    Authentication
    Passwords are hashed with bcrypt + salt, never stored in plaintext. OAuth is supported for passwordless sign-in. Sessions use secure HTTP-only cookies.
  4. 04

    AI chat, Research, Draft & your data

    Your data is never used to train AI models
    When you use AI chat, Research, or Draft, relevant prompts route through exactly two AI providers: OpenAI, which generates the response, and DeepInfra, which ranks which patent passages are most relevant to your question. Both are accessed exclusively through their business API tiers, never consumer products like ChatGPT. OpenAI's API terms are explicit: data sent to the OpenAI API is not used to train OpenAI's models unless the customer opts in. Patent Bear does not opt in. DeepInfra's API terms likewise bar training on customer inputs without explicit consent, which we do not give. These are the providers' contractual commitments, not just policy statements, and they are reflected in our own Terms of Service.
    What is sent
    For chat, Research, and Draft, we may send the patent text, selected claims, pasted invention or product descriptions, generated elements, evidence snippets, and your instructions as needed to provide the requested analysis. Billing details and account credentials are not sent to our AI providers.
    Zero Data Retention with every AI provider
    Every AI call Patent Bear makes runs under Zero Data Retention. OpenAI has enabled Zero Data Retention on our organization under a signed Modified Retention Amendment, and our Data Processing Agreement with DeepInfra commits it to Zero Data Retention. Those providers do not log what we send them, do not retain it for abuse monitoring, and never use it for training. We call only stateless API endpoints, with no provider-side assistants, file stores, or conversation storage. The one exception is images of published patent drawings, which are public documents outside OpenAI's retention amendment. Your durable data lives in Patent Bear's own systems, under your control.
    Transient worker processing, keyed by an anonymous ID
    Research jobs run on our private worker services keyed by an anonymous account identifier. Workers hold job data only for the time needed to complete the task; no user work product is intentionally saved to worker disk. Completed outputs and durable state are stored back in Patent Bear's database or object storage so there is one controlled place to retain, export, or delete account data.
    Connected AI assistants
    When you connect Patent Bear to an AI assistant such as Claude, ChatGPT, or Gemini, the assistant calls Patent Bear's server with your authorization, and the results you request are returned to it. From there, the assistant's provider processes them under your agreement with that provider, which Patent Bear does not control. The two-provider statement above covers Patent Bear's own processing. Each connection can be revoked from your plan page, and credit-consuming actions run only after you confirm the cost.
    Data you control
    Conversations, Research runs, and drafts are stored in your account so you can revisit them. Delete conversations or request account deletion at any time; deletion removes active application records, subject to limited backup retention.
  5. 05

    Access control

    Row-level security
    Every database query is scoped to the authenticated user through row-level security policies. These are enforced at the database, not the application, so even if app code had a bug, the database itself would prevent unauthorized access.
    No third-party tracking
    No advertising pixels or cross-site tracking scripts. Privacy-friendly analytics, when enabled, is limited to aggregate product usage and excludes raw patent queries, pasted work product, credentials, and billing details. We do not sell or provide your data to advertisers or data brokers.
    Operational access
    Administrative access is limited to operational need, protected by provider controls, and used for debugging, reliability, billing, abuse prevention, and security response.
  6. 06

    Payment security

    Stripe
    All payment processing is handled by Stripe, a PCI DSS Level 1 certified processor. Patent Bear never sees, processes, or stores your credit card number.
    No financial data on our servers
    Your billing information lives at Stripe. We only store a Stripe customer ID to manage your subscription.
  7. 07

    Your data rights

    Ownership
    Your annotations, saved patents, search history, chats, Research inputs and outputs, and drafts are yours. We will never claim ownership of your work product or use it for anything other than providing the Service to you.
    Export
    Request a full export anytime and we'll provide a complete dump of your annotations, saved patents, chat history, and saved Research and Draft data where available.
    Deletion
    Delete your account any time. All active application data (annotations, saved patents, search history, chats, Research runs and outputs, drafts, and account info) is permanently removed. Cannot be undone.
  8. 08

    Our own SOC 2

    SOC 2 Type II: pending
    The certifications named on this page belong to our infrastructure providers, not to Patent Bear itself. Our own SOC 2 Type II attestation is pending; we will publish the report here when it is complete. In the meantime, this page describes the controls we actually run, and we are happy to answer security questionnaires directly.
Report a vulnerability? We take every inquiry seriously.security@patentbear.com →