Security and data protection
Your workspace holds passports, licences and health certificates. This page explains, without marketing language, where that data lives, who can reach it and what happens when you delete it.
We do not currently hold an independent security certification. Everything below is a practice you can verify in the product or in our legal documents, not a badge.
Where your data lives
- Database and application run in the European Union (Amsterdam). Uploaded files are stored in Cloudflare R2 with the European Union jurisdiction restriction; public access to the bucket is disabled.
- All traffic passes through Cloudflare and is encrypted in transit (TLS, HSTS). The application accepts requests only through Cloudflare.
- Payments are handled by Stripe as Merchant of Record. We never receive or store card numbers.
- AI document reading sends a file to our AI provider only when you select it for upload, only to suggest a type and dates; the provider's response is not stored and our logs never contain document content.
- Reminder emails go through a transactional email provider. Any additional reminder channel is switched on only with the user's own consent in their settings.
Who can access what
- No passwords to leak: sign-in by one-time email link, or with Google or Microsoft (verified email addresses only). You can sign out of every device at once from Settings.
- Four roles: owner, admin, member and read-only viewer. Deleting documents, editing records, managing the team and the plan are limited to owners and admins.
- Every workspace is isolated: each query is scoped to the workspace and this boundary is covered by automated tests that run on every change.
- Files are never public. Each download uses a signed link valid for five minutes, issued only to a signed-in member of that workspace.
- Document request and upload links are stored only as a one-way hash, expire after 14 days and can be revoked at any time.
Storage, backups and deletion
- Daily automatic database backups. Files are never overwritten: every upload creates a new version, so an earlier version can be restored.
- The application connects to the database with a restricted role; schema changes run separately with elevated rights.
- A per-request Content Security Policy with nonces, strict security headers and rate limits on sign-in, uploads, AI reading and outbound email.
- Deleting a document removes its files. Deleting a workspace or account permanently removes documents and files within 30 days, except records we must keep by law.
Monitoring and review
- An audit log records who added, renewed, deleted, requested or exported what and when; owners and admins can export it.
- Security events (sign-ins, sign-outs everywhere, deletions, admin views) are kept even after a user or workspace is deleted.
- Dependencies are scanned in continuous integration; secrets are rotated without downtime.
- Two internal security reviews in September 2026 covered authentication, workspace isolation, uploads, rate limits and logging; all findings were fixed. The reports are kept in the repository.
What we do not do
- No advertising or cross-site tracking cookies. Public-page analytics is cookieless and never runs inside the signed-in app or on upload links.
- We do not sell personal data and do not use your documents for anything other than providing the service.
- We do not store card details, passwords or the audio of voice input.
Reporting a vulnerability
If you believe you have found a security issue, email us and we will reply within two business days. Please do not test against other customers' data. [email protected]
Details and the list of sub-processors are in our Privacy Policy and Data Processing Agreement.
Last reviewed: 2026-09-28