Security
What protects your documents, described specifically
Nothing on this page is an adjective. Every claim names the mechanism doing the work, because a claim you cannot check is a claim you should not accept.
Tenancy
Two organizations cannot see each other
The usual way to keep customers apart is for application code to remember to add a filter to every query. It works until one query forgets, and the failure is silent: the wrong data is returned and nothing errors.
The database enforces it, not our code
Every table holding your data carries a row-level security policy, and the connection the application uses cannot bypass it. A query that forgets its filter returns nothing rather than somebody else’s rows.
Proven by trying to break it
Our test suite asks the permission layer for access to another organization’s document, receives a yes, issues the query anyway, and asserts that the database refuses. It also reads the database catalogue to check that every table carrying an organization id has a policy, so a new table cannot be added without one.
Even the foreign keys are tenant-aware
An earlier version could be tricked into attaching a record to another tenant’s document, because the database checks foreign keys with row security off. Keys are now composite, so the reference has to match the organization as well as the record.
The audit chain
History that cannot be quietly rewritten
Each record is hashed with the one before
The history forms a chain. Altering any single record breaks it at that exact point, which means tampering is not merely discouraged. It is detectable, and localisable.
Append-only, enforced by triggers
Update and delete on the history table are refused by the database itself rather than by our code being careful. Triggers bind even the database owner, which is the reason they were chosen over permissions.
Every read is recorded before it happens
Documents are served through the application, never as a shareable pre-signed storage link. The access is written to the chain first; if that write fails, the bytes do not move.
Access
Sign-in, roles, and signing links
No passwords to leak
Sign-in is a six-digit code sent to your email. There is no password database, so there is no password database to breach, and attempts are rate limited per address and per network.
Four roles, no matrix
Owner, admin, member, viewer. An organization always has at least one owner; the last one cannot be demoted or removed. There is no permission matrix to misconfigure.
A signing link is a single-use capability
It is tied to one recipient, it carries no session, it stops working once used or once the document is finished, and it can be given an expiry. Its token is stored hashed, so our own database does not hold a working link.
Data
Where it lives, and when it stops
Deletion is real, and it leaves proof
A deleted document stays recoverable for a window you set: thirty days by default, up to a year. After that the file is permanently destroyed and a tombstone remains: the history, the hashes and the certificate survive, so an audit of a deleted document still answers what happened to it.
Encryption and integrity
Documents are stored as objects, encrypted at rest by the storage layer, and served over TLS. Every version records the SHA-256 of its own bytes, so a file that changed in storage would not match the certificate that describes it.
Honesty
What we have not done yet
A security page that lists only strengths is a marketing page. These are real gaps, and they are on the plan rather than on this list of features:
- No SOC 2 or ISO 27001 report. We are too early for the audit to mean anything, and buying the badge before the practice would be the wrong order.
- No SAML or SCIM. It gets built when an organization needs it to say yes, not before.
- No customer-managed encryption keys or data residency choice.
- No third-party penetration test. Our own suite attacks the tenant boundary, which is not the same as somebody else trying.
What we store and why is set out in the privacy policy.
Read the rest before you decide
The audit trail page explains the chain in more detail, and the documentation covers how retention, reminders and roles behave in practice.
Start free150 documents a year free for nonprofits. No credit card to start.