Security, procurement and compliance
The four questions that stop a content deal: who owns the words, is it plagiarised, do we have to say it was AI-assisted, and where does our data go. This chapter answers all four in the form a buyer's procurement, legal or compliance person will ask them, plus the invoicing rules that keep you paid.
The four answers, short
- Ownership. The customer owns everything on payment: articles, briefs, images. Austen keeps no reuse right and no publication right.
- Plagiarism. Articles are generated, not assembled from copied text, and research grounds them rather than being pasted in. No automatic plagiarism scan runs by default. If a customer needs one, it is agreed and priced at kickoff. Do not claim a guarantee you do not measure.
- AI disclosure. Austen's position is that disclosure is the customer's decision, that Austen supports either choice, and that Google itself says disclosure adds context for readers.S36 Where a customer resells the content, their own platform or client contract may require it.S31
- Data. The brief, the brand voice, uploads and the article text reach the model providers, Anthropic and OpenAI. The article and its brief reach Proofed's human editors. Card details reach Stripe and never touch Austen.
1. Content ownership
| Question | Answer to give |
|---|---|
| "Who owns the finished article?" | "You do, outright, on payment. Full rights, worldwide, in perpetuity, with no attribution requirement." |
| "Who owns the briefs?" | "You do. They are part of the deliverable, not a working file we keep." |
| "Who owns the images?" | "You do, on the same terms. They are generated for your article and are not licensed stock." |
| "Can you reuse our content for anyone else?" | "No. Not for another customer, not as a sample, not as a case study, unless you agree in writing to a specific use." |
| "Do you train models on our content?" | "Austen does not train models. It calls commercial APIs. If a buyer needs the model provider's own position on training from API traffic, point them at the provider's current terms rather than paraphrasing them, and check that page on the day you answer." |
| "What about our style guide and brand voice?" | "Yours. It lives in your project and leaves with you. If you cancel, ask for it and you get it back in structured form, which is usually better than the PDF you gave us." |
| "What if we cancel mid-pilot?" | "You keep every article delivered and every brief approved. We stop, and nothing is clawed back." |
| "Can we say we wrote it?" | "Yes. There is no attribution requirement in either direction. What you tell your readers is the disclosure question below, and it is your call." |
The clause to put in the agreement. "On payment in full, all right, title and interest in the delivered articles, briefs and images passes to the customer, worldwide and in perpetuity. The supplier retains no licence to reuse, republish or reference the deliverables, and will not name the customer without prior written consent." The full wording is in Chapter 12, and it should go past a solicitor once before first use.
2. Plagiarism and originality
| Question | Answer | Type |
|---|---|---|
| "Is this copied from somewhere?" | "No. Articles are generated from a brief and a plan, not assembled from retrieved text. Live research grounds the article in real sources rather than supplying sentences to paste." | True of the pipeline as built |
| "Do you run a plagiarism check?" | "Not by default. If you need one, say so at kickoff and we will build it into the process and price it." | Honest |
| "Can you guarantee originality?" | "We do not guarantee what we do not measure. What we can commit to is that if you run a check and find a genuine match, we rewrite the piece at no charge." | A commitment you can keep |
| "What about facts and citations?" | "The article is researched against live sources. It is not a fact-checking service, and your reviewer remains your reviewer. If you need factual verification as a distinct step, that is a different product and we will say so rather than pretend." | Boundary, state it early |
| "What about our competitors' content?" | "The competitor crawl produces a gap analysis, meaning subjects and coverage, not text. It tells you what they cover, not what they said." | True of the crawler |
Never say "100% original" or "plagiarism free". Both are claims a customer can test and a competitor can attack, and neither is measured today. "Generated, not copied, and rewritten free of charge if you find a genuine match" is stronger because it is defensible.
3. AI disclosure policy
Write this down once and use the same wording everywhere, because inconsistency between a sales email, the pilot agreement and the website is what a careful buyer notices.
Austen's disclosure position. Every article is produced by an AI content pipeline from a brief the customer approves, and is edited by a professional human editor before delivery. Whether that is disclosed to the customer's readers is the customer's decision. Austen will supply a disclosure line on request, will not object to disclosure, and will not require it. Where the customer is bound by a platform rule, a client contract or a professional obligation that requires disclosure, that obligation takes precedence and the customer is responsible for meeting it.
| Where it comes up | What applies |
|---|---|
| Search visibility | Google's published guidance says using generative AI to generate many pages without adding value for users may violate the scaled content abuse spam policy, that generative AI can be useful for research and structure, and that sharing how content was created can help give readers context. Page last updated 10 December 2025.S36 |
| Selling through Fiverr | AI use is conditional disclosure: no label is required in a gig description, but it must be disclosed on request, and a buyer's pre-order "no AI" instruction must be honoured.S31 |
| Agency reselling to a client | Their client contract governs. Ask the agency to check it before the pilot, not after. If a specific client has a no-AI clause, do not use Austen on that account and say so plainly. |
| Publisher branded content | The sponsor's contract governs. Get the disclosure rules in writing at kickoff. |
| Academic or education content | Institutional policy governs, and it varies by institution. Ask which policy applies to marketing and prospectus copy, which is usually different from the policy on student and research work. |
| Regulated claims (financial, medical, supplements) | Disclosure is not the issue; the claim is. The customer's own reviewer stays in the loop and Austen does not replace them. |
A suggested disclosure line, if a customer asks for one. "This article was produced with AI assistance from a brief approved by our team and was edited by a professional editor before publication." It is accurate, it is short, and it says the useful part, which is that a person edited it.
4. Data handling
| What | Where it goes | Say this |
|---|---|---|
| Brief, plan, brand voice, article text | Anthropic and OpenAI, over their commercial APIs, routed per job purpose. An admin can route any text task to either providerS5 | "Your brief, brand voice, uploads, imported articles and draft go to the model providers, and so do public pages we read for research. Nothing else does." |
| Article and its brief, for editing | Proofed, over its API, where human editors read it | "The same editorial firm that handles Proofed's managed clients, under the same terms." |
| Style guide and glossary | Stylus, provisioned per account or team, with a guide linked to each project | "Your style guide lives as structured rules linked to your own project." |
| Uploaded audio or video | Transcription model, then stored with the project | "Only what you upload. Delete it and it is gone." |
| Crawled competitor pages | Fetched by Austen's crawler; every user-supplied URL and every redirect hop passes an SSRF guard | "We crawl public pages, at a rate limit, and we do not crawl anything behind a login." |
| Card details | Stripe only | "We never see them. Stripe holds them and we hold a customer reference." |
| Account credentials | None. Single-use magic link, Google OAuth, or sign-in with an existing Proofed account. Turnstile on the magic-link form | "There is no password to leak, because there is no password." |
| Single sign-on | Not built. The Enterprise plan lists SSO, but the code has no SAML or OIDC sign-in through a customer's identity providerS1 | "Not today." Never promise it or a date for it without engineering sign-off. |
| API and assistant access | Passport OAuth2 for assistants over MCP, and Sanctum personal tokens that are either account-wide or limited to one project; idempotency keys on writes | "A project token cannot reach another project through the API." Do not say this of MCP yet: the MCP endpoint does not enforce a token's project limit. |
| Outbound integrations | Webhooks signed HMAC-SHA256. Inbound CMS and Stylus callbacks verified by HMAC, and a site with no secret is refused; Stripe by its signature; Proofed by a shared key | "Signed, so your CMS can verify the request really came from us." |
| Transactional mail | Mailgun | Only if asked. |
Three things to check before you answer a security questionnaire. One, which country and legal entity the Austen production infrastructure actually sits in, and give the same answer everywhere, always. Two, each model provider's current data-retention and training position, on the day you answer, because these terms change. Three, whether you have a data processing agreement ready, because a university, a law firm or a publisher will ask for one and "I will draft something" is a two-week delay. None of those three is settled in this repository, and this guide will not invent an answer for them.S35
1
Write the one-page security summary before the first education or law-firm call
Hosting location and entity, subprocessor list, authentication, encryption in transit and at rest, retention and deletion, incident contact, and who to write to for a DPA. One page. Every buyer above about 500 staff will ask for it, and having it ready is worth more than any feature on the product page.
The subprocessor list, as a buyer will want it
| Subprocessor | Purpose | What reaches it |
|---|---|---|
| Anthropic | By default: research, article generation, planning, scoring, briefs. Any text task can be routed to either model provider | Brief, plan, brand voice, research notes, article text, and page text read for imports and competitor analysis |
| OpenAI | By default: images, transcription, embeddings, clean-up of transcripts and uploads, reading the customer's website at setup. Any text task can be routed to either model provider | Image prompts and visual reference images, uploaded audio, transcripts and uploaded documents, homepage text, page text for embedding, and the brief, brand voice and article text of any task routed to it |
| Proofed | Human editing, and optional sign-in with a Proofed account | The article to be edited, its brief, the project name and the article title |
| Stylus | Style guides, glossary, voice profiles | Account name and email, style rules, preferred spellings, voice samples |
| Stripe | Payments and subscriptions | Name, email, billing details, card data (held by Stripe, not Austen) |
| Mailgun | Transactional email | Email address and message content |
| Optional sign-in and Search Console performance data | Only if the customer connects it | |
| Cloudflare Turnstile | Bot protection on the magic-link form | Request metadata |
| Slack | Internal notifications to the Austen team | Name, email, IP address and approximate location, device type, article titles on editing orders, account deletions |
| ip-api.com | Approximate location of an IP address, for those notifications and the admin user page | IP address, over plain HTTP. Move it to HTTPS or remove it |
| Fathom Analytics | Cookieless visit analytics on the marketing site and sign-in pages | Page visits and request metadata |
This list was read from the Austen code on 30 September 2026. Confirm it against production configuration before it goes into a customer-facing document, and keep one canonical copy so the website, the security summary and the DPA cannot disagree.
5. Outbound and marketing compliance
| Rule | What to do |
|---|---|
| Email companies, not individuals | Every target on the list is a company. Write to a role at a company, never to a personal address. |
| Identify yourself in every email | Company name, registered office and an unsubscribe line at the foot of every outbound email, on both sides of the Atlantic. |
| Honour opt-outs the same day | Keep a suppression list, check it before every send, and never re-add anyone to a sequence. |
| Keep a privacy notice you can link to | One URL, in the email footer, saying what you hold and how to be removed. |
| No personal data in the target list | The list in Chapter 7 and its CSV contain job titles only, deliberately. Keep it that way. |
| Get advice on the specific regimes | UK and EU direct-marketing rules and US commercial-email rules differ, and this guide is not legal advice. Get the rules confirmed once, in writing, before the first bulk send, and write them into the outbound process rather than remembering them. |
6. Invoicing
| Rule | Detail |
|---|---|
| Pilot: paid before work starts | Guest Stripe Checkout, once the pilot branch is merged (it is not live yet), or an invoice at net 14 with work starting on payment. Provisioning happens on the payment webhook and is idempotent, so a Stripe redelivery cannot create a second set of slots.S3 |
| Retainer: monthly in advance | Always. A done-for-you month costs you real editor money before the invoice date. |
| Subscriptions: card on file | Cashier and Stripe. Annual is 12 months for the price of 10 and is the cleanest cash improvement available.S1 |
| Agencies: one invoice, to the agency | Never to their client, never a copy to their client. Put it in the agreement. |
| Above $5,000: split it | 50% on signature, 50% on delivery. |
| Purchase orders | Universities, law firms and publishers often need a PO number on the invoice. Ask for it at kickoff, not at the point of invoicing, or you will wait a month. |
| Card fees | Stripe publishes 1.5% + 20p for standard UK cards, 2.5% + 20p for EEA cards and 3.15% + 20p for international cards plus 2% for currency conversion; Invoicing is 0.4% capped at $2.00 per invoice.S37 On a $2,500 pilot paid on a US card, invoicing is dramatically cheaper than a card. |
| Marketplace fees | Upwork takes roughly 15% to 20% all in; Fiverr takes a flat 20% of every order including extras.S30S31 Price marketplace work at the same $2,500 and accept the lower net, or do not list. |
| Tax | All prices are stated excluding VAT or sales tax. Get the cross-border position confirmed by an accountant once, before the first invoice, and put the resulting wording on the invoice template. |
| Late payment | Retainer work pauses at 14 days overdue, after one written reminder. Say it in the agreement so pausing is not a confrontation. |
What this chapter is not
- Not legal advice. The ownership clause, the DPA and the tax treatment each need a professional to look at them once. This chapter tells you what to ask them.
- Not a completed security pack. Hosting location and entity, model-provider retention terms, and the DPA itself are all open and are flagged above rather than guessed at.
- Not a certification claim. Austen holds no security certification this guide can evidence. Do not imply one on a questionnaire. "Not certified, and here is what we do instead" is an acceptable answer to most buyers under 1,000 staff and an unacceptable one above that, which is useful to know before you chase an enterprise deal.