Security
Your company documents, protected.
DocuTrackr tracks the dates that matter, not your paperwork. This page is the whole picture — what we do today, and what we have not built yet.
AES-256-GCM
Authenticated field encryption
convex/encryption.ts
200,000
PBKDF2 iterations on passcodes
convex/security.ts
2 years
HSTS max-age, preloaded
next.config.js
30 days
Deletion grace, then automated purge
convex/users.ts
What happens to a document
Three steps, and the photograph stops at the first one.
Your device
ON-DEVICEYou photograph a document. Tesseract reads it in the browser, on your machine, and pulls out the handful of fields we need. The scan itself is not uploaded — the on-device path has no network call at all.
In transit
TLSOnly the extracted fields travel, over TLS. HSTS is set for two years with includeSubDomains and preload, so there is no plain-HTTP path to fall back to.
At rest
ENCRYPTEDDocument numbers and free-text notes are stored as AES-256-GCM ciphertext. Dates, labels and document types are stored in the clear — they are what drives your reminders and search.
In place today
On-device scanning by default
The OCR engine runs in your browser and is structurally incapable of phoning home — a unit test asserts it makes no network call even when both local engines fail. Sending a page to our AI extractor is a separate button you press, per document, after being told what it does.
Authenticated encryption on sensitive fields
AES-256-GCM with a random 12-byte IV and a 16-byte authentication tag, so tampering with stored ciphertext is detected rather than silently decrypted. Key rotation is implemented and re-encrypts existing rows.
Server-enforced organization isolation
Every business query and mutation resolves your organization server-side before it touches data. Roles are Owner, Admin and Member, and the check is in the resolver — not hidden in the UI, where a crafted request would walk straight past it.
Share links require your second factor
Minting a secure share link hands documents to someone outside every other check, so it is treated as an exfiltration path: an unverified session cannot create one. Links carry a 32-byte token plus a separate 10-character access code, and expire in 72 hours by default.
Passkeys, verified on the server
WebAuthn registration and authentication are verified server-side against a stored public key with a monotonic signature counter, and the relying-party origin is checked against an allowlist so a client cannot claim its own.
Sign-in codes that lock out attackers, not you
Email sign-in codes expire in 10 minutes, allow 5 wrong attempts, are limited to 3 sends per 10 minutes, and are bound to the session that requested them — a code phished into another browser is useless.
Insert-only audit log
Around 66 distinct actions — documents added and removed, members invited and role-changed, share links created and revoked, sign-ins, admin actions — are written and never updated or deleted. Owners and admins read their organization's log from Settings.
Hardened response headers
X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, a Permissions-Policy that denies microphone and geolocation outright, and HSTS preloaded for two years.
Deletion that actually completes
Deleting an account starts a 30-day grace period. We email you at day 23, and a daily job then permanently removes the profile, documents, reminders, share links, passkeys and push subscriptions. A non-identifying audit trail is deliberately kept.
What we store, and what we don't
For a tracked document we keep the label, type, issuing country and the dates. The document number and any notes you write are encrypted. The photograph you scanned is not uploaded at all.
One deliberate exception: business contract analysis. If you upload a contract for parties-and-dates extraction, that file is stored, because the feature exists to let you open it again later. It is the only path that keeps a document, and you choose it per upload. Everything else in the product keeps dates, not documents.
Who can get in
Sign in with a password, a one-time email link, a Google account, or a passkey. Passwords must be at least 12 characters with an uppercase letter and a digit; they are hashed by our auth layer and never reach us in the clear.
Team invitations carry a link token and, optionally, a six-digit code you give the person verbally — so a forwarded invite email is not on its own enough to join your organization.
Owners and admins can change roles and remove members at any time. To be precise about a limit: removing a member revokes their access on the next request their browser makes, rather than reaching out and killing an already-open session. If someone leaves under difficult circumstances, remove them and then rotate anything they knew.
Encryption, stated plainly
Sensitive fields are encrypted with AES-256-GCM before they are written. Encryption happens on our servers, not in your browser — so this is not end-to-end, and we do not describe it as zero-knowledge.
The master key that wraps the data keys currently lives in our deployment secrets. That means a database-only breach yields ciphertext, but an attacker who also obtained our deploy secrets could decrypt those fields. Moving that key into a hardware-backed KMS is the top item on the roadmap below, and until it ships we would rather you knew.
Infrastructure and sub-processors
The application runs on Vercel; data lives in Convex Cloud's US region. Durability, replication and backup are properties of those platforms — we point you at their own documentation and agreements rather than restating guarantees we do not operate.
The sub-processors that can see customer data are:
- Convex — database and server functions
- Vercel — application hosting
- Resend — transactional email
- Stripe — billing (card data goes to Stripe directly; we never receive it)
- Cloudflare — Turnstile bot checks; receives a browser signal, never a document
- Anthropic — only for features you invoke: opt-in cloud extraction, contract analysis, reports and the assistant
- Twilio — WhatsApp delivery, where you enable it
We do not sell, rent or share your data with advertisers or data brokers, and there is no advertising or analytics vendor with access to document contents.
Getting your data out, and getting rid of it
Export your document register as CSV or PDF from the Documents screen, and compliance reports as CSV or HTML from Reports. To be accurate about the current state: there is no single “export everything” button in Settings yet.
Deleting your account begins a 30-day grace period, with a reminder email a week before the end. After that, a daily job permanently destroys profiles, documents, reminders, share links, passkeys and push subscriptions. We keep the audit trail, which carries no document contents, as a compliance record.
You are the controller of your organization's data and we are the processor. We support the access, export and erasure rights GDPR requires; we have not been audited against it, and we do not claim a certification we do not hold.
Bot protection
Sign-in, sign-up, password reset, document upload, enterprise enquiries, newsletter and feedback all carry a Cloudflare Turnstile check — a privacy-preserving alternative to a CAPTCHA, with no tracking cookie, no puzzle, and usually nothing at all to see.
Turnstile never receives a document, an expiry date, or anything you type. It scores the browser and issues a token, and that token is the only thing we hand back.
On the enterprise, newsletter and feedback forms the check is verified on our server as part of the submission, so it cannot be skipped. On sign-in, sign-up, password reset and upload it runs as a check before the request — it turns away automated traffic without being a hard gate, and it stands down if Cloudflare is unreachable, because locking a customer out of their own compliance data is the worse failure.
Not built yet — stated so you can plan around it
KMS-held master key
Field encryption keys are currently wrapped by a master key held in our deployment secrets. AWS/GCP KMS is stubbed in code but not enabled. Until it is, an attacker who obtained both the database and our deploy secrets could decrypt those fields — we would rather say so than imply otherwise.
SOC 2 Type II
Not started, not certified, and not claimed anywhere else on this site. Planned once the business has the operating history an audit period requires.
Third-party penetration test
Planned post-launch. There is no bug bounty programme yet — see responsible disclosure below in the meantime.
Regional data residency
Today everything lives in Convex Cloud's US region. Customer-selectable EU or Gulf residency is under evaluation and is not offered yet.
Responsible disclosure
Found a vulnerability? Email security@docutrackr.app. We acknowledge reports within 48 hours, patch critical issues before public disclosure, and will credit you publicly with your permission. There is no bug bounty yet.
Please do not test against accounts you do not own, access other organizations' data, or run denial-of-service tests.
Security review or questionnaire?
Email hello@docutrackr.app and we will walk through our posture in detail, complete your security questionnaire, or arrange a technical review call.
Every claim on this page describes shipped code — nothing here is aspirational.