Security and trust
What happens to a document you send to DocSolved.
This page answers the questions a security review asks first. Each row says what DocSolved does today and how that is established. Items we cannot yet prove are listed as open, not omitted.
Verified established in the application code or configuration and checked by the test suite Provider-stated relies on a hosting or AI provider's published commitment Open not yet confirmed; being worked on
The facts
| Topic | What DocSolved does | Status |
|---|---|---|
| Encryption in transit | TLS on every connection, HTTPS enforced with a preloaded Strict-Transport-Security header. Webhook deliveries are HMAC-SHA256 signed so receivers can verify origin and integrity. | Verified |
| Encryption at rest | The production database and stored document objects are encrypted at rest by the hosting providers (managed PostgreSQL and S3-compatible object storage, AES-256). DocSolved adds no separate application-level encryption layer on top. | Provider-stated |
| Authentication | User sign-in is delegated to Clerk; DocSolved never stores passwords. API keys are random 256-bit tokens stored only as a hash, scoped (extract, history), shown once, and revocable immediately. Admin access uses PBKDF2-SHA256 with HttpOnly cookies and CSRF protection. | Verified |
| Tenant isolation | Every saved analysis and stored file is namespaced to the owning account or workspace. Reads re-check ownership; stored files are reachable only through short-lived, owner-scoped links. Isolation across accounts and workspaces is covered by an internal audit and automated tests. | Verified |
| Retention | Documents analyzed without saving are processed in memory and not written to your history. Saved analyses are kept until you delete them. No time-based automatic deletion is configured for saved analyses. Operational records expire on their own: share-link access logs after 180 days, webhook delivery logs after 30 days, async job batches after 7 days. | Verified |
| Deletion | Delete any record, or everything, from the app at any time; stored files and derived artifacts go with it. Deleting your account erases your history, jobs, API keys, share links and lifecycle records. Workspace documents stay with the workspace. | Verified |
| Model training | Your documents and extracted data are never used to train models, by us or by our AI providers, whose API terms exclude request data from training. | Provider-stated |
| Subprocessors | AI extraction runs on OpenAI (United States, or the EU endpoint in EU-processing mode) or OVH AI Endpoints (European Union). Identity, payments, hosting, OCR, object storage and error monitoring providers are listed with their regions on the subprocessor list. | Verified |
| Logging | Application logs carry request identifiers, routes and timings, never document content, extracted values or OCR text. Error monitoring runs with personal data stripped and share tokens redacted. | Verified |
| Security headers | A strict, nonce-based Content-Security-Policy, X-Frame-Options DENY, nosniff, same-origin opener and resource policies, and a Permissions-Policy that disables camera, microphone and geolocation. | Verified |
| Reporting a vulnerability | Email [email protected]. We aim to acknowledge within 72 hours. The same contact is published in /.well-known/security.txt. |
Verified |
| Backups | The hosting provider takes automated daily database backups and object storage keeps version history. The backup retention window and a documented restore test are not yet published. | Open |
| Data processing agreement | A DPA and the current transfer basis for each subprocessor are available on request from [email protected]; a self-serve DPA is not yet published. | Open |
| Third-party attestation | DocSolved has not been independently audited or certified (no SOC 2 or ISO 27001 report). Security reviews so far are internal and their findings are tracked in the repository. | Open |
| Availability commitment | No uptime guarantee is published yet. The application currently runs as a single instance with health checks and automatic restarts; a public status page is planned. | Open |
Read the detail
- Security section of the Terms (authentication, storage, headers, infrastructure)
- Data trust: no model training, retention, EU processing mode, access controls
- Data retention: what is kept, for how long, and how to delete it
- Subprocessors and their regions
- Privacy policy
- API error model and request identifiers
Frequently asked questions
Do you use my documents to train AI models?
No. Your documents and the data extracted from them are not used to train AI models.
How long is my data kept, and can I delete it?
Analysis history is retained for a configured period and then automatically pruned, and you can delete it on demand. The data-retention section lists what is kept and for how long.
How is my data protected?
Documents are encrypted in transit, with provider-managed encryption at rest, and each account's data is isolated. The security table on this page marks which facts are verified in the code and which rely on a provider's commitment.