Security and data handling
You trust us with documents that matter. This page describes what we actually do with them today.
How your documents are handled
- Every upload is scanned for malware and checked for type and size before any processing starts.
- Documents are processed asynchronously by background workers we operate. Each document belongs to one workspace, and every database query is scoped to that workspace.
- Document text is passed to AI models as data, never as instructions, and every result is validated against your document type's fields before it is delivered.
- Results are delivered only to you: in the workspace, through the API with your keys, or to webhook endpoints you register (signed with HMAC-SHA256).
AI providers and model training
- Customer documents and extracted results are not used to train AI models — not ours and not our providers'.
- We call AI providers through their business APIs with no-training settings, and zero-retention options where the provider offers them.
- Each workspace can restrict which AI providers may process its documents.
- Improving our shared, ready-made document types from your reviewed corrections is opt-in per workspace and off by default.
Encryption and secrets
- All traffic uses TLS (HTTPS only, with HSTS).
- The database and object storage encrypt data at rest.
- AI provider credentials are encrypted with AES-256-GCM envelope encryption and are never shown again after entry.
- API keys are stored only as SHA-256 hashes; we show a key once at creation. Passwords are hashed with bcrypt.
Retention and deletion
- By default, source files are deleted 30 days after upload and extraction results one year after processing.
- Workspace administrators can change these periods and delete individual documents at any time.
- Deletion removes the stored file and its database records; backups expire on the provider's schedule.
- You can ask us to delete your workspace together with all of its documents and results.
Access control
- Workspace roles separate administration, review and read-only access; API keys carry scopes, an optional project binding and an expiry.
- Our staff can open a workspace only through a time-limited, recorded support grant.
- Administrative, configuration and access changes are recorded in an audit log.
Sub-processors
These companies process customer data on our behalf. AI providers receive documents only for workspaces routed to them.
| Sub-processor | Purpose | Data |
|---|---|---|
| Vercel | Hosts the web application and API | Requests in transit, application logs |
| Prisma Postgres | Primary database | Account data, document metadata, extracted results |
| Object storage provider (S3-compatible) | Stores uploaded source files and rendered pages | Source documents |
| OpenAI | AI classification and extraction, when configured for your workspace | Document pages and text sent for processing |
| Anthropic | AI classification and extraction, when configured for your workspace | Document pages and text sent for processing |
We will update this list before adding a sub-processor.
Audits and reporting a vulnerability
We have not yet completed an independent third-party security audit or certification. When we do, the reports will be listed here. Until then we are happy to answer security questionnaires.
Found a security issue? Please contact us with the topic “Security or privacy”. We acknowledge reports promptly and do not pursue good-faith research.