Security and privacy
Hemingway Editor Plus keeps your data private.
Hemingway Editor Plus helps you improve your writing without using your content to train AI models. We protect your writing, prompts, saved instructions, and AI output.


No document storage
Your working document stays in your browser or where you save your Word files.
No AI training
Hemingway and its AI providers do not use your writing, prompts, instructions, or AI output to train, fine-tune, or improve AI models. We do not sell this content.
Secure sign-in
Sign in through email, Google, or your organization’s identity provider with Enterprise SSO.
Security details
Hemingway Editor Plus
These details cover Hemingway's web app and Microsoft Word add-in, including hosting, sign-in, AI processing, permissions, and data protections.
Security overview
Hemingway Editor Plus is a cloud-based software-as-a-service application. It is a writing analysis and improvement tool that helps teams improve mass communications, internal communications, grants, sales proposals, and other written work.
Hemingway uses local analysis and cloud-based AI to help with writing. The web app runs in your browser. The Microsoft Word add-in is a separate installation covered by the same service protections.
Teams often deem Editor Plus low-risk because content edited in Hemingway is usually intended to become public once the writer has finished editing it.
User authentication
Hemingway Editor Plus uses WorkOS for authentication, with Google sign-in and one-time email verification. Single sign-on (SSO) is available as an optional add-on on the Enterprise Plan.
This approach avoids Hemingway-managed passwords. It also lets organizations enforce the two-factor authentication and security controls they already use for email or Google accounts.
Single sign-on (SSO)
The optional Enterprise SSO add-on lets your organization connect its identity provider through WorkOS, including SAML-based SSO. Your team can use its existing company sign-in and the authentication controls your IT team manages, such as multi-factor authentication.
An organization administrator selects a recovery contact from existing administrators, verifies ownership of the organization’s email domain, and configures and tests the identity provider in the WorkOS setup portal.
Completing the setup test enables SSO for the verified domain and requires it for future sign-ins.
Enterprise setup is coordinated with Hemingway support. To discuss SSO for your organization, contact support.
Hosting and encryption
Hemingway Editor Plus is hosted on Render, a platform-as-a-service provider built on Amazon Web Services and Google Cloud. Servers and storage are hosted in the United States for all users. Render lists SOC 2 Type 2 among its compliance standards.
Editor Plus uses AES-256 encryption for secure communication, including communication with client web browsers and between servers. Data retained in the database is encrypted at rest.
Privacy, PII, data retention, and AI training
Hemingway Editor Plus uses Plausible for basic, cookie-free audience and traffic-source measurement. Optional Mixpanel product analytics is limited to approved, content-free events and runs only when enabled in your privacy choices. Sentry records runtime exceptions needed to keep the service working. Customer writing is excluded from these analytics and error-reporting systems.
We handle account, team, sign-in, billing, usage, and requested support information, as well as the text needed for AI features. Our Privacy policy explains the information involved, its purposes, and your choices.
Editor Plus does not provide a mechanism for uploading and storing documents on our servers. When analyzing or rewriting parts of a document, Hemingway transmits the content to our server, relays it to an LLM hosting provider, and returns the result to the user. Hemingway currently uses OpenAI, Google, or Anthropic for LLM hosting.
We do not store document content after processing. Content is processed in memory and discarded. LLM providers may retain content temporarily, usually for 30 days, for security audits before discarding it. LLM providers cannot use customer data to train AI models.
You keep your ownership rights in the content you submit. Hemingway transfers to you any rights it has in the AI output it returns. This does not guarantee that every output is copyrightable, unique, or free of another person's rights.
User account data retained in Hemingway systems can be deleted at your request. This retained data is limited to user account information.
User roles and permissions
Hemingway Editor Plus includes three roles with different levels of access to sensitive resources.
- Admin Only: for IT, finance, or other admins who need to manage billing, team members, and permissions, but do not use editing features. This role does not consume a Team Plan user license.
- Admin User: similar to Admin Only, with the added ability to use Hemingway editing features. This role consumes a Team Plan user license.
- User: for general team members. Users can access editing features and consume a user license, but cannot access billing or team management.
Security audits
Hemingway Editor Plus does not yet have SOC 2 or ISO certification.
If your organization has security, procurement, or vendor review questions that are not covered here, contact us and we can route the request for review.
Hemingway Editor Classic for Mac and PC
Classic is the downloadable desktop product. It uses a local-only security model for organizations that need content to stay on the device.
Desktop app security model
Hemingway Editor Classic for Mac and PC is a downloadable desktop app, not a web app.
Classic does not connect to Hemingway servers. Your writing stays on your device, and your content never leaves your device.
Classic includes Hemingway readability analysis and issue highlighting, but it does not include the AI rewriting, tone, length, or other AI features available in Editor Plus.
Because Classic runs locally and does not use AI, it is a strong choice for organizations that require absolute data and content security. It also works well for teams that do not want to use AI tools or cannot use them.
Need a security review? Have other questions?
You can read through our Terms and associated documents for more information. Contact Hemingway support if you need further assistance or have additional questions.
Contact support