How we protect your documents

Documents and jobs belong to an organisation, and people see them through their place in it.

• Every request is checked on our servers against the person's role.
• Admins manage people, roles and the plan. Staff can't see the email or mobile of people from other companies, unless they manage a job those people are on.
• Free plan jobs are public: anyone with the link, code or QR code can open them. Paid plans can keep a job private.
• An audit log records who did what to people, roles and jobs.

WorkOS runs sign-in and sessions. Codes sent to a mobile come from us.

• You sign in with a one-time code sent to your email or mobile.
• Codes expire after 10 minutes, and lock after five wrong tries.
• You can see where you're signed in, and sign out of other sessions.
• Enterprise plans can add single sign-on, by agreement.

Your information is encrypted on the way to us and where it's stored.

• In transit, using TLS.
• At rest, using AES-256, by Convex for the database and Cloudflare R2 for files.
• Links to files expire within an hour, most after 15 minutes.
• Stripe takes your card. We never see or store the full number.
• Every upload is scanned with ClamAV before it's processed or anyone can open it. ClamAV finds known malware, not all malware.

Most of it is overseas, and we'd rather you knew that up front.

• The main database is in the United States (Convex, on AWS).
• Files are in Cloudflare R2. We prefer its Oceania region, though that isn't a guarantee of location.
• Files being prepared for conversion are handled on AWS in Sydney.
• Need it held in a particular country? We don't offer a choice of region yet, so email support and tell us where. It helps us decide what to build next.

See every provider and where it is

AI helps with documents. It doesn't decide anything about people.

• It only works on a document when someone in your organisation asks, or turns on a step that does.
• We only use providers that keep no copy of what we send and don't train on it.
• We keep requests and responses to check quality. Only our staff with administrator access to AI records can read them.

Read how AI features handle your content

Staff only reach what their job needs.

• Staff have limited roles, for support, billing, content and administration.
• Some staff can sign in as a customer, to fix a problem you've raised or to deal with a security issue.
• Secrets are kept out of our code, and our code goes through automatic checks before it ships.

These are our providers' certifications, not ours. Their reports cover their part of the service.

• Convex and WorkOS: SOC 2 Type 2.
• Vercel: SOC 2 Type 2 and ISO 27001.
• Cloudflare and AWS: independent security reports, published through their trust centres.
• Stripe: PCI Service Provider Level 1.

We'll tell you what we know, and what you may need to do.

• We'll tell affected customers without undue delay, and within 72 hours where we can.
• If a breach is likely to cause serious harm, we'll tell the people affected and the regulator, as the law requires.

SafetyDocs is new. Ask us if you need something on this list.

• SafetyDocs doesn't hold its own SOC 2 or ISO 27001 certification, and Mitti's don't extend to it.
• We haven't had an independent penetration test of SafetyDocs yet.
• We can't keep your data in Australia only. Email us if you need this
• We don't have an uptime guarantee on self-serve plans. See our status page

Found something? We want to hear from you.

• Email what you found and how to reproduce it. We'll reply as soon as we can. Email our security team
• Don't access more of other people's data than you need to show the problem, don't disrupt the service, and give us time to fix it before you tell anyone else.
• If you follow these rules, we won't take legal action against you for good-faith research. We don't run a paid bug bounty yet, but we're looking into it as we scale.