Security
How we store, share and delete your clients’ documents. Everything here is true of the product today. None of it is a promise for later.
A document is encrypted in your browser, under a key unique to that one file, before it reaches our storage. We hold the keys; our storage provider holds only bytes it cannot read. Files uploaded before this shipped stay as they were, in the same private bucket.
Each download is a signed link that stops working after two minutes, so a link left in an old email or chat opens nothing — and for an encrypted document, the link discloses nothing readable even inside those two minutes.
A client contact sees only the document groups their role covers. In the firm, auditors see their own clients; managers and owners see all. Rules are enforced in the database, not only on the screen.
Row-level rules sit on every table — clients, engagements, documents, billing, notifications — and a query runs as the person who signed in, so a hidden button is never what keeps two firms apart. The tables behind the email outbox and the sign-in attempt log carry no user-facing rule at all: nothing but the server itself can read them.
Every upload, approval, send-back, waiver, reopening and restore is written to a record the database itself refuses to edit — a correction is a new entry, never a change to an old one. Purging an archived client writes its own line: who, when, why, how many files. Opening or downloading a file is not recorded.
The file type is checked against the bytes, not just the name. A program renamed to .pdf is refused, and files are capped at 50 MB. Once a file is accepted it cannot be quietly swapped: storage refuses to overwrite it, and replacing or deleting a stored file is not a permission any signed-in account holds.
A client access code tolerates ten failed attempts in fifteen minutes from one person, then refuses them. Every attempt is recorded, right or wrong. A firm can rotate a client's code whenever it likes: the old one dies the moment the new one exists, and contacts already admitted are untouched.
Archived clients are kept for the years you choose (7 by default). A purge removes the files and the records, and writes one line to a purge log: who, when, why, how many files.
Cards are entered on Stripe's own page. We never see or store card numbers. Sign-in is email and password, or Google.
Hosting
The database and the files are on Supabase (PostgreSQL and object storage). The application runs on Cloudflare. Email is sent through Resend. One region today; ask us if your firm needs a specific one.
Due diligence
Send it over. We answer every line against how the product works, with the gaps named as gaps. On data protection law — GDPR, CCPA and the rights they give people over their own data — the Privacy Policy sets out what we collect, why we hold it, and how to have it corrected or deleted.
Fieldwork starts with the documents in hand.
A clean, audit-ready record.
Clients see only their part.
From $49 a month · Client contacts free and unlimited · Cancel any time