Skip to content
DocInfra

Security

Designed with enterprise security requirements in mind.

Documents carry contracts, medical records and financial data. The platform is being built around that from the first line of code.

  • Encryption in transit

    TLS on every public endpoint. No plain HTTP for API traffic.

  • Isolated workers

    Conversion engines run in separate containers, apart from the API.

  • Malware scanning

    Uploaded files are scanned before any engine opens them.

  • Configurable retention

    Short default retention for inputs and outputs, adjustable per account.

  • Document deletion

    Delete a document and its derivatives through the API at any time.

  • API authentication

    Scoped API keys stored hashed, with rotation and revocation.

  • Audit trails

    Who did what to which document, and when, per job step.

  • Rate limiting

    Per-key limits that protect your quota and the shared platform.

  • Private deployments

    Keep processing inside your own network when policy requires it.

The private alpha already scans every file for malware, converts in isolated containers without internet access, stores API keys hashed, deletes documents automatically after 24 hours (or sooner on demand through the API), delivers signed webhooks for job events, enforces per-key rate limits and keeps an audit trail. The rest is design work for a product that is not generally available. We do not hold SOC 2, ISO 27001, HIPAA or any other certification, and we will not claim one until an independent audit says so.

The life of a document

This is the path a file follows in the private alpha today. Items marked as planned describe the design, not a running system.

  • The file arrives on a request authenticated with an API key that is stored only as a hash. In production the API is served over TLS.
  • Its type is checked by content, not only by extension, and it is written to private object storage. The original filename never becomes part of a storage path.
  • A job is queued. A worker scans the file with ClamAV before any engine opens it. Infected files are rejected and deleted at once.
  • Clean files are converted by an engine in an isolated container with no access to the internet or to other services, and the PDF goes back to private storage.
  • Downloads use signed links that expire after five minutes. The storage bucket is never public.
  • Every step is recorded in the audit trail with the account, time and outcome. Inputs and outputs are deleted automatically after 24 hours, and you can delete them sooner on demand with DELETE /v1/documents/{id}.

What we will not claim

We do not hold SOC 2, ISO 27001, HIPAA or any other certification or attestation today. If and when we do, this page will link to the report. Until then, treat everything here as design intent that you can question during the beta.

Reporting a vulnerability

If you find a security issue in this website, write to security@example.com. Please do not test against other people’s data or run automated scans that degrade the service.

Private deployment

Run it in our cloud, or inside yours.

Some documents should never leave your network. The same API and processing workers are being packaged to run in your own infrastructure, with the same contract as the hosted service.

  1. Private alpha

    Cloud SaaS

    Managed by us. The fastest way to start.

  2. Roadmap

    Private Cloud

    A dedicated, single-tenant environment operated for you.

  3. Roadmap

    VPC

    Processing inside your own cloud account and network boundary.

  4. Roadmap

    Kubernetes

    Container images and charts for your existing clusters.

  5. Roadmap

    OpenShift

    Packaging aimed at regulated, on-premise enterprise environments.

Data residency. Files, keys and logs stay in the region and network you choose.

Same API. Code written against the hosted service works against a private deployment by changing the base URL.

Your identity provider. Planned integration with your existing OpenID Connect provider.

Private beta

Get early access.

We are onboarding a small group of teams first. Tell us a little about your documents and we will be in touch.

  • Early API keys as soon as conversion is ready
  • Direct line to the people building it
  • Your use cases shape what ships next
  • Honest answers about what is ready and what is not

We only use your email to contact you about the beta. See the privacy notice.