AI patent platform security: eight questions to ask before you upload anything

Before an R&D team puts confidential questions or internal documents into an AI patent platform, ask for the audit report (SOC 2 Type II or ISO 27001 certificate), the hosting region, a written no-training clause, retention terms, SSO, and whether every answer links to its source patents. GetFocus offers SAML SSO and patent-linked answers; check each vendor's own trust page.

Security questions for AI patent tools differ from ordinary SaaS reviews in one way: your questions themselves are sensitive. A query such as "solid electrolyte interphase additives for sodium-ion" tells a reader where your roadmap is heading. The eight questions below cover the data you send, the data you upload and the answers you get back. For each, we show what vendors publish today, taken from their own pages in November 2026. We build GetFocus, an AI patent platform for R&D leaders, so we include it where its documentation answers the question.

1. Which audit can you send us: SOC 2 Type II, ISO 27001, or both?

A SOC 2 Type II report tests controls over a period of time; a Type I report checks design at one point. ISO 27001 certifies the information security management system. Ask for the report or the certificate and its scope.

Published examples: Patsnap is certified to ISO/IEC 27001:2022 by SGS and lists a SOC 2 Type I report, with Type II in progress (Patsnap trust center). Patlytics states SOC 2 Type 2, ISO 27001 and ISO 42001 (Patlytics security). Clarivate lists ISO 27001 and SOC 2 Type II for Derwent Patent Search, Derwent Patent Analytics and Derwent Patent Monitor (Clarivate trust center).

2. Where is our data hosted, and can we choose the region?

Patsnap stores EU/EEA data in Frankfurt and US data on AWS in Virginia (Patsnap trust center). XLSCOUT offers servers in the USA or the EU on Microsoft Azure (XLSCOUT security controls). IPRally runs on Google Cloud (CSA STAR registry entry).

3. Are our questions, uploads or outputs used to train any model, yours or your LLM provider's?

Get this in the contract, and ask about the vendor's model providers too. IPRally: "Nothing you search or draft is stored by ourselves or our partner LLM providers or used to train any model" (IPRally). Cypris says customer data is "never used to train LLMs or shared with third-party model providers for training purposes" (Cypris security). Patsnap's wording covers "general-purpose models" (trust center); ask what that excludes.

4. How long do you keep our history, and can we delete it?

Patlytics stores user history for 90 days, deletable (Patlytics security). Patsnap lets users request deletion of prompts, uploads and outputs (trust center).

5. Can we analyse internal or unpublished material, and where does it go?

This is the core of "internal patent database analysis". Cypris offers a knowledge-management product to "Centralize your internal R&D data and make it work alongside external intelligence" (Cypris). Patlytics accepts uploads for infringement, freedom-to-operate and invention-disclosure work (Patlytics). Patsnap's Eureka Enterprise plan lists "File upload controls" (Eureka). If you need the whole stack on your own servers, PQAI is open source under the MIT licence and documents local deployment for experimentation and development (PQAI on GitHub).

6. Do you support SSO, role-based access and tenant isolation?

GetFocus supports SAML 2.0 single sign-on with identity providers such as Okta, Azure AD, Google Workspace, Ping and OneLogin (GetFocus SSO guide). Cypris supports SSO "with all leading IdP providers" and separates tenants logically (Cypris security). Eureka Enterprise lists "SSO and enterprise security controls" and role-based permissions (Eureka).

7. Is data encrypted in transit and at rest, and to what standard?

PatSeer states AES-256 at rest and TLS 1.3 in transit, alongside ISO/IEC 27001:2022 and SOC 2 Type 2 (PatSeer; PatSeer press release, 30 Apr 2024). Cypris and Patlytics both state encryption in transit and at rest (pages above).

8. Can every answer be traced to the patents behind it?

The first seven questions protect what you send. This one protects the decision you make with the answer: an R&D call built on an AI answer needs its evidence. In GetFocus, Chat with Set shows "exactly which patents the AI used to answer your question" and hyperlinks each patent it mentions (Chat with Set). Our forecasts are an explainable regression on two citation metrics, and every number traces back to the patent record (GetFocus method). Ask every vendor to show the same on your own question.

What vendors publish today

"Not stated" means the vendor's pages we checked in November 2026 did not say; ask them.

FAQ

What security certification should an AI patent platform have?

Ask for a SOC 2 Type II report or an ISO 27001 certificate, with scope. Several patent AI vendors publish one or both on their trust pages.

Do AI patent tools train on my searches?

Vendors differ. IPRally, Cypris, PatSeer, Patlytics and XLSCOUT publish statements that customer data is not used for training; Patsnap's covers general-purpose models. Get the clause in your contract.

Can I analyse my own unpublished patents with AI?

Some vendors accept uploads (Cypris, Patlytics, Patsnap Eureka Enterprise). For full control, open-source PQAI can run on your own infrastructure.

Which platform links answers to source patents?

Ask for a live demo on your question. GetFocus links each answer to the patents it used and traces every forecast number to the patent record.

Does GetFocus forecast or search?

We built GetFocus to forecast which competing technology will win by measuring improvement rates from the patent citation network. It is not a prior-art, freedom-to-operate or portfolio-valuation tool (GetFocus).