Trust Center

AES-256 server-side encryption on all stored documents and data via AWS S3.

TLS 1.2+ enforced on all connections. HSTS enabled with 2-year max-age.

PostgreSQL with encryption at rest via Supabase managed infrastructure.

bcrypt with cost factor 12 for all user-facing passwords (share links).

Four-tier role system: Owner, Admin, Member, Viewer. Granular permission checks on all API endpoints.

Enterprise SSO via Clerk. Multi-factor authentication supported.

SHA-256 hashed API keys with per-key permissions and rate limiting.

Secure session tokens with automatic expiry via Clerk.

SHA-256 checksums computed and stored for every generated document. Tamper detection on verification.

Comprehensive audit logging of all user actions, API calls, and system events with IP tracking.

Automated data retention enforcement: audit logs (2 years), share links (30 days post-expiry), webhook logs (90 days).

Time-limited share links with optional password protection, view limits, and revocation.

Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

Four-tier rate limiting on all endpoints: dashboard (60/min), write (20/min), public (30/min), export (5/min).

HMAC-SHA256 signed webhook payloads. Auto-disable after 10 consecutive failures.

Server-side validation on all API inputs. Parameterized database queries via Prisma ORM.

Full data portability via /api/gdpr/export. Download all organization data as JSON.

Complete data deletion via /api/gdpr/delete. Removes all DB records and S3 objects.

Only collect data necessary for document generation. No tracking pixels or third-party analytics.

See our sub-processor list below for all third parties that process your data.

Audit engagement planned. All technical controls are in place.

Self-assessment questionnaire (CAIQ) in progress.

Data export, deletion, consent management, and DPA available on request.

California Consumer Privacy Act compliance via GDPR controls.