Your documents contain sensitive information. We protect them with the same infrastructure trusted by Fortune 500 companies.
How we protect your data
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Your documents are never transmitted or stored unencrypted.
Documents and AI processing run on Microsoft Azure, a SOC 2 Type II certified platform with HIPAA and GDPR compliance.
Our application runs on Cloudflare's global edge network with DDoS protection, WAF, and ISO 27001 certification.
Role-based access control (RBAC) ensures only authorized users can access your documents. Multi-factor authentication available.
Built-in HIPAA and GDPR controls with audit trails, data retention policies, and Business Associate Agreements (BAA) available.
Our infrastructure undergoes regular security audits and penetration testing. We follow industry best practices for secure development.
Built on trusted platforms
All document storage and AI processing happens on Azure, Microsoft's enterprise cloud platform.
Our application runs on Cloudflare's global edge network for performance and security.
Industry certifications
Our infrastructure providers maintain the highest security and compliance standards.
Azure
Independent audit of security, availability, and confidentiality controls.
Cloudflare & Azure
International standard for information security management systems.
Azure
Healthcare data protection compliance with BAA available.
Azure & Cloudflare
EU data protection regulation compliance for user privacy.
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Encryption keys are managed by Azure Key Vault with automatic rotation.
We use role-based access control (RBAC) to ensure only authorized users can access documents. Authentication is handled by Clerk.com with support for multi-factor authentication (MFA).
Each customer's data is logically isolated. Your documents are never shared with other customers or used to train AI models.
All access to documents is logged with timestamps, user IDs, and actions performed. Logs are retained for compliance and security monitoring.
We have a documented incident response plan and will notify affected users within 72 hours of any security breach, as required by GDPR.
We conduct regular security audits, penetration testing, and dependency scanning. Critical vulnerabilities are patched within 24 hours.
If you discover a security vulnerability, please report it to us at [email protected]. We take all reports seriously and will respond within 48 hours.
Please do not publicly disclose vulnerabilities until we've had a chance to address them.
We're happy to discuss our security practices in detail. Contact our security team.