Security and Responsible Reporting
Use a secure account and keep a copy of important files. Contact us privately about a suspected security problem.
Last updated:
Account and file controls
Passwords are hashed. Processing requires a verified account. Result downloads require authentication, ownership and an expiring signed URL. Saved document content is encrypted with the application key.
What these controls do not promise
Security controls do not eliminate all risks. Editing overlays are not secure redaction, malware scanning is not currently integrated and a processed document should not be treated as a certified safe attachment.
Report a suspected vulnerability
Send the affected URL, a short description and minimal reproduction steps through the contact form with Security report as the subject. Do not include credentials or private documents.
Keep testing limited
Do not access another person’s account or files, disrupt service, extract data or publish sensitive details in order to demonstrate a problem. The contact route is for responsible reporting; it is not permission for intrusive testing.