Enterprise-Grade Security

Your documents contain sensitive information. We protect them with the same infrastructure trusted by Fortune 500 companies.

Security First

How we protect your data

End-to-End Encryption

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Your documents are never transmitted or stored unencrypted.

Azure Infrastructure

Documents and AI processing run on Microsoft Azure, a SOC 2 Type II certified platform with HIPAA and GDPR compliance.

Cloudflare Edge Network

Our application runs on Cloudflare's global edge network with DDoS protection, WAF, and ISO 27001 certification.

Access Controls

Role-based access control (RBAC) ensures only authorized users can access your documents. Multi-factor authentication available.

Compliance Ready

Built-in HIPAA and GDPR controls with audit trails, data retention policies, and Business Associate Agreements (BAA) available.

Regular Audits

Our infrastructure undergoes regular security audits and penetration testing. We follow industry best practices for secure development.

Infrastructure

Built on trusted platforms

Microsoft Azure

All document storage and AI processing happens on Azure, Microsoft's enterprise cloud platform.

  • Azure Blob Storage (R2): Encrypted document storage with geo-redundancy
  • Azure OpenAI: AI processing with data residency controls
  • Azure Cognitive Services: OCR and entity extraction
  • Compliance: SOC 2, ISO 27001, HIPAA, GDPR

Cloudflare

Our application runs on Cloudflare's global edge network for performance and security.

  • Workers: Serverless compute at the edge
  • DDoS Protection: Automatic mitigation of attacks
  • WAF: Web Application Firewall blocks threats
  • TLS 1.3: Latest encryption for all connections

Compliance

Industry certifications

Our infrastructure providers maintain the highest security and compliance standards.

SOC 2 Type II

Azure

Independent audit of security, availability, and confidentiality controls.

ISO 27001

Cloudflare & Azure

International standard for information security management systems.

HIPAA

Azure

Healthcare data protection compliance with BAA available.

GDPR

Azure & Cloudflare

EU data protection regulation compliance for user privacy.

Our Security Practices

Data Encryption

All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Encryption keys are managed by Azure Key Vault with automatic rotation.

Access Control

We use role-based access control (RBAC) to ensure only authorized users can access documents. Authentication is handled by Clerk.com with support for multi-factor authentication (MFA).

Data Isolation

Each customer's data is logically isolated. Your documents are never shared with other customers or used to train AI models.

Audit Logging

All access to documents is logged with timestamps, user IDs, and actions performed. Logs are retained for compliance and security monitoring.

Incident Response

We have a documented incident response plan and will notify affected users within 72 hours of any security breach, as required by GDPR.

Vulnerability Management

We conduct regular security audits, penetration testing, and dependency scanning. Critical vulnerabilities are patched within 24 hours.

Responsible Disclosure

If you discover a security vulnerability, please report it to us at [email protected]. We take all reports seriously and will respond within 48 hours.

Please do not publicly disclose vulnerabilities until we've had a chance to address them.

Questions about security?

We're happy to discuss our security practices in detail. Contact our security team.