Security
Your documents are business-critical. Here's how we protect them at every layer.
Encryption everywhere
All traffic is encrypted with TLS 1.2+. Documents and extracted data are encrypted at rest in AWS (S3 and DynamoDB server-side encryption).
Isolated multi-tenancy
Every record is partitioned by organization at the database level. Cross-tenant access is structurally impossible — every query is scoped to your organization's key.
Strong authentication
Sign-in is backed by AWS Cognito with short-lived JWT tokens, optional TOTP multi-factor authentication, and enforced password complexity.
Role-based access control
Four roles (Admin, Manager, Analyst, Viewer) with server-side permission checks on every API call — not just hidden buttons in the UI.
Full audit trail
Every upload, edit, approval, export, and settings change is logged with the actor, timestamp, and source IP, and is visible to your admins.
Hardened AI pipeline
A multi-layer prompt-injection defense screens document content before AI processing, and AI providers are contractually barred from training on your data.