Security & privacy at DocsFlow

The short version

• •Every workspace is completely isolated — your documents are never mixed with another company's, and your data can't be queried from another workspace.
• •Files are encrypted with AES-256 both in transit (TLS 1.3) and at rest in our systems.
• •An additional layer of AES-256 encryption, unique to your workspace, protects your content — giving you a second line of defense on top of the industry baseline.
• •Your documents are never used to train public AI models — enforced contractually with every AI provider we integrate.
• •GDPR compliant with full deletion-on-request, and built to modern enterprise security standards.

Security architecture

Workspace isolation

Every workspace is fully isolated at the database level using row-level security. Your documents, users, and search results are scoped to your workspace on every read and write — there is no admin override in the application. Search results are filtered by workspace before they ever reach the AI.

Encryption in transit

All traffic between you, our servers, and our partners runs over TLS 1.3 with modern cipher suites. Certificate management is handled by industry-leading providers.

Encryption at rest

Uploaded files and database records are encrypted at rest with AES-256 across every storage layer — the baseline every enterprise SaaS ships.

Additional encryption layer, unique to your workspace

On top of the at-rest baseline, we apply a second layer of AES-256-GCM encryption to the content we use for AI search, using a key that is unique to your workspace and derived from a master key held in our secrets store.

• Uses AES-256-GCM, the same authenticated encryption standard used by banking systems — any tampered content is rejected automatically.
• Every workspace has its own encryption key, generated the first time you ingest a document.
• Content is decrypted transparently when you search — you see no difference, and the AI only ever sees your original text.

Authentication & access control

User authentication is handled by Clerk, a SOC 2 Type II certified identity provider. Sessions use short-lived, rotated tokens. Only members you invite can access your workspace, and every request is checked against workspace membership at the database level.

AI providers & data handling

We use OpenAI, Anthropic, and Google models via enterprise APIs with zero-retention and no-training terms. Your documents and queries are never used to train any foundation model.

Audit logging

Every upload, query, membership change, and access event is recorded in a workspace-scoped audit log. Enterprise and Custom plans include audit log export to your own security tools.

What we protect against

• One customer's data being accessible from another customer's workspace
• Traffic being intercepted between you and our servers
• Your content being exposed if a single storage layer is compromised — which is why we run a second encryption layer unique to your workspace
• Silent tampering of your content — any modified content is rejected automatically
• Your documents leaking into public AI training sets — this is prohibited contractually with every provider we use
• Unauthorized access from stolen or compromised sessions — tokens are short-lived and scoped to your workspace

Have stricter requirements? Single sign-on (SSO/SAML), custom-managed encryption keys, on-premise deployment, and dedicated data residency are all available on the Custom tier. Talk to sales and we'll scope it against your security requirements.

Compliance

Responsible disclosure

Found a vulnerability? We'd like to hear about it before an attacker does. Email security@docsflow.app with reproduction steps. We commit to:

• Acknowledging receipt within 2 business days
• A first-pass severity assessment within 5 business days
• A fix timeline (or a justified decision not to fix) within 10 business days
• Public credit at your discretion once the issue is resolved