Our approach
These principles guide how the DocsFlow AI platform is designed and operated.
Use industry-standard HTTPS/TLS for data transmitted between users and the platform.
Traffic to docsflowai.net is served over HTTPS. The site sends an HTTP Strict Transport Security (HSTS) header so browsers keep using encrypted connections on return visits.
Design document access around authenticated users and isolated account permissions.
Documents belong to the account that uploaded them. Access is designed around authenticated sessions, and accounts are isolated from one another at the application layer.
Only retain information required to deliver the service.
We collect the information needed to process documents and operate an account, and avoid collecting data we do not need. Uploaded documents are not used for advertising.
Give customers clear information about how uploaded documents are stored and deleted.
We document how long uploaded files and extraction results are kept and how they can be deleted. Retention details are described in our Privacy Policy and will be updated as the platform evolves.
Monitor application infrastructure and service health.
We monitor application health and errors so we can detect and respond to problems quickly. Logs are kept only as long as they are useful for operating and securing the service.
Data lifecycle
Documents are sent from your browser over an encrypted HTTPS connection.
Files are processed only to extract the information you asked for and return structured results to your account.
Uploaded files and results are associated with your account and are not shared with other customers.
Retention and deletion practices are documented in our Privacy Policy and will be kept up to date.
In place today
These controls are configured on this website right now. You can verify most of them by inspecting the response headers of any page.
Content Security Policy
Restricts scripts, styles, images, and connections to our own origin and blocks plugin content.
Clickjacking protection
Pages cannot be embedded in frames on other sites (frame-ancestors 'none' and X-Frame-Options: DENY).
Strict transport and MIME handling
HSTS keeps browsers on HTTPS; X-Content-Type-Options prevents content-type sniffing.
Limited browser permissions
A Permissions Policy disables camera, microphone, and geolocation access for the site.
No third-party trackers
The marketing site does not load advertising or analytics scripts, and fonts are self-hosted.
Protected contact forms
Form submissions are validated server-side, rate limited, and protected against cross-site request forgery.
DocsFlow AI is an early-stage company and does not currently hold third-party security certifications or attestations such as SOC 2 or ISO 27001. We will not display certification badges unless we have actually obtained them. If your organization has specific compliance requirements, contact us and we will give you an accurate picture of where we stand.
If you believe you have found a security vulnerability in DocsFlow AI, please report it privately so we can investigate and fix it. Please include steps to reproduce, avoid accessing data that is not yours, and give us reasonable time to respond before any public disclosure.
security@docsflowai.net