Security

• Our servers, file storage, email sending and DNS run on Amazon Web Services in the United States (us-east-1).
• Payments are handled by Stripe. Card numbers are entered with Stripe and never reach our servers.
• The full list of sub-processors is in the DPA sub-processor table.
• All traffic uses HTTPS (TLS).
• Uploaded files and database backups are encrypted at rest using AWS server-side encryption.

• Passwords are stored hashed, never in plain text.
• Sessions use HttpOnly cookies, and forms are protected against cross-site request forgery (CSRF).
• Sign-in attempts are rate limited: repeated failed attempts from one network address or for one email address are temporarily blocked.
• Password reset links work once.
• Customers can turn on two-step sign-in with an authenticator app. Recovery codes are provided.
• Organization admins can require two-step sign-in for all admins, with a 7-day grace period.
• Our own staff must use two-step sign-in, and their actions in the back office are logged.

• Each organization's records and files are separated in the application and the database. Every query is scoped to the signed-in organization.
• Vendor portal links are private and unguessable, with one link per vendor. A link can be replaced at any time. Vendors do not need accounts, and each link reaches only that vendor's own requirements and upload form.
• Only PDF, PNG and JPEG files are accepted. Each file is checked for type and size and scanned for malware before it is stored.
• Uploads, edits, approvals, role changes, exports and administrative actions are recorded in the audit trail, with who did it and when. Admins can view the trail and export data as CSV or zip at any time.
• API keys are shown once and stored hashed. Webhook destinations are checked to prevent requests to internal addresses, and webhook payloads are signed.
• Deleting an account removes its data from live systems within 30 days and from backups within 35 days. See our privacy policy and terms of service. Data export is always available.

• Encrypted database backups are taken nightly and kept for 35 days.
• A documented restore drill, which proves a backup can be restored, is part of our monthly operations checks.
• Application containers run with reduced privileges and pinned image versions.
• Dependencies are reviewed and updated, and security fixes are applied on a priority basis.
• If a personal data breach affects your data, we notify the affected account owner without undue delay and within 72 hours. See DPA section 6 on breaches.

If you think you have found a security issue, please report it through our contact form and put "Security" in the subject line. We will acknowledge your report and investigate it.

While testing, please do not access other customers' data and do not disrupt the service.

• We do not hold any third-party security certification yet, such as SOC 2 or ISO 27001.
• Security is shared. Customers manage their own team, their roles, and who receives vendor portal links.
• No system is perfectly secure. If something goes wrong, we will tell you as described in the DPA.