Purpose. This page is a plain-English summary of how US Vet Help protects the data veterans entrust to us — for veterans deciding whether to use the tool, and for anyone reviewing how we handle their data. US Vet Help advises and prepares; it does not represent veterans or file claims.
1 · Data we handle
Account data
Email address only. Sign-in is passwordless (magic link). No stored passwords.
Uploaded records
VA/DoD medical records, decision & rating letters, service records. May contain PHI and PII.
VA connection
Retired. US Vet Help no longer connects to the VA or pulls official VA records; it works only from records you upload or enter.
Payment data
Handled entirely by Stripe. We never see or store card numbers.
2 · Encryption
- In transit: all connections use TLS 1.2+ (HTTPS). No plaintext transport.
- At rest: the storage volume is encrypted (AES-256). Uploads land in an access-restricted, non-public directory on our own server.
- Backups: encrypted with a key we control (
rclone crypt) before leaving the server, then stored off-site. Because we encrypt with a key we control, the provider cannot read the files.
3 · Access control
- A veteran can access only their own records — enforced by an authenticated session cookie (
usv_session, HttpOnly, Secure). No cross-account access. - Uploaded files live in a
chmod 700private tree, server-side only, never exposed to the browser. - Administrative access is limited to the operator (a single 100%-disabled veteran founder) over key-based SSH.
- No third party can access a veteran's record.
4 · AI processing
To read and analyze records we call one AI provider — Anthropic (the Claude models), through Anthropic's API. Controls:
- Records are sent over an encrypted (TLS) connection and processed with access controls and audit logging. Anthropic does not use data submitted through its API to train its models.
- Records are never used to train AI models.
- Where practical, personally identifying details are reduced before analysis. Structured-output schemas carry no PHI — only generic field names.
- No other AI vendor receives veteran records.
5 · VA connection (retired)
US Vet Help previously offered an optional "Connect with VA" feature (VA OAuth, read-only, per-session consent). That integration has been retired. We no longer connect to the VA, request VA credentials, or pull official VA records — the tool works solely from records you upload or information you enter.
6 · Retention & deletion
- Veterans control their uploads — delete any file at any time from the analyzer.
- A veteran can request full deletion of their account and all associated data at privacy@usvethelp.org.
- We retain data only as long as needed to provide the service to that veteran.
7 · Subprocessors
| Subprocessor | Purpose | Safeguard |
|---|---|---|
| Anthropic (Claude models) | Document analysis & OCR | TLS · no training on API data · US-based AI provider |
| Encrypted-backup provider | Off-site backups | our-key encryption (provider cannot read) |
| Stripe | Payment processing | PCI-DSS Level 1 |
We do not sell data, and we do not share records with the VA, DoD, or any third party for their own use.
8 · Infrastructure
- Dedicated server on Oracle Cloud Infrastructure (U.S. region). No shared/consumer cloud storage for records.
- TLS certificates auto-renewed; HTTPS enforced with modern security headers.
- Reverse proxy gates authenticated app + API routes; public tools remain public.
- Regular OS patching and encrypted, tested off-site backups.
9 · Compliance posture
US Vet Help is an educational, self-service preparation tool. It is not VA-accredited and does not prepare, present, or prosecute claims for a fee (38 C.F.R. § 14.626 et seq.). It is not affiliated with or endorsed by the VA or DoD. It is a direct-to-consumer tool: you choose what information to provide, and we are not a HIPAA covered entity or business associate. Information you provide is processed with encryption, access controls, and audit logging, is never sold, and is never used to train AI.
10 · Contact
Security or privacy questions: privacy@usvethelp.org. See also our Privacy Policy and Terms of Service.
US Vet Help is a service of Outlaw Holdings LLC and is not affiliated with the U.S. Department of Veterans Affairs. We do not file claims or represent veterans. Built by a 100% disabled combat veteran.