Data flows in LADLE are deliberately simple. Fewer hops means fewer places data can leak. This page enumerates every one.
Chat flow (user prompt → model response)
- 1. Browser → Vercel edge: Your prompt travels over HTTPS (TLS 1.2+) to the nearest Vercel edge node. IP address is logged transiently (~24h) for abuse detection; content is not stored at the edge.
- 2. Vercel edge → LADLE origin (Vercel serverless function): Request is authenticated against your session token. Function runtime lives in us-east-1.
- 3. LADLE origin → Supabase: A new message record is created in the database. Row-level security enforces that this record is only readable by your account (or a workspace admin for team accounts).
- 4. LADLE origin → Anthropic API: Your prompt is sent to Anthropic's Claude Sonnet endpoint with zero-retention mode enabled. Anthropic processes the prompt, generates a response, and returns it token-by-token via Server-Sent Events. Anthropic does not store your prompt or response beyond the request window.
- 5. LADLE origin → Browser: Streaming response returned as SSE. Each token is also appended to the Supabase message record.
- 6. Final state: The chat is stored in Supabase. Only you (and, on a team account, your admins via explicit export request) can read it.
File upload flow
- 1. Browser uploads file via authenticated HTTPS POST to Vercel origin.
- 2. File is deduplicated by content hash and stored in Supabase Storage (backed by AWS S3, us-east-1). Access-controlled to your account only.
- 3. When you send a message that references the file, the file's content is included in the prompt sent to Anthropic (subject to file-type support — see /docs/file-types-and-limits).
- 4. File persists in Supabase Storage until you delete the chat (or, for project files, delete the project). Deletion cascades within 30 seconds; backup copies removed within 24 hours.
Billing flow (subscription charge)
- 1. On subscribe or renewal, your card is charged by Stripe (PCI DSS Level 1). Card data never touches LADLE infrastructure.
- 2. Stripe returns a tokenized reference + last-four; only these are stored by LADLE.
- 3. LADLE's billing engine earmarks the $8 (or plan-appropriate portion) for WFP.
- 4. On the last day of the month, LADLE aggregates all earmarked amounts and sends a single donation to WFP via ShareTheMeal (a payment leaves LADLE PBC's bank; no customer identity is transmitted to WFP).
- 5. ShareTheMeal returns a reference number; LADLE publishes the receipt on /impact/reports.
Never-happens flows
- Chat content is never shared with third-party analytics, ad networks, or LLM training pipelines.
- Your data is never shared with WFP or ShareTheMeal beyond the anonymous aggregate donation amount.
- Personal data is never sold, rented, or shared with data brokers (see /legal/privacy-choices).
- Support staff do not browse chats unless you explicitly grant access for a specific support case.
Regions
SEE /LEGAL/SUBPROCESSORS FOR EACH VENDOR'S DPA · SEE /LEGAL/DPA FOR OURS