security,
written down.

In place

• Encryption in transitThe service only runs over HTTPS with HSTS; sign-in and session cookies are marked Secure and HttpOnly.
• Encryption at restStored documents are encrypted with AES-256-GCM, with a separate key derived for each organization.
• Isolation between organizationsEvery organization’s data is separated with row-level security in the database, so one team cannot read another’s records.
• Virus scanningEvery upload is scanned before processing. If the scanner is unavailable the file is held back, never passed through unchecked.
• Safe document processingFiles are checked by content type, converted to plain black-and-white pages in an isolated process, and every version is fingerprinted with SHA-256.
• Two-factor sign-inSign-in uses one-time email codes. Team workspaces also require an authenticator app, with single-use recovery codes.
• Session controlEvery signed-in device is listed and can be signed out; sensitive actions ask for a fresh two-factor check.
• Audit trailSign-ins, role changes and sensitive actions are recorded with who did what and when.
• Abuse protectionSign-in attempts and verification codes are rate-limited; carrier and payment notifications must carry a valid signature.
• Strict browser policyA strict Content Security Policy allows only our own scripts and styles; pages cannot be framed by other sites.