Security

Architecture

Docsfra is built for workloads where documents are the sensitive asset. Security controls are part of the platform's design, not an add-on tier.

• Tenant isolation at the database layer: PostgreSQL row-level security (RLS) — even if application-level filtering were bypassed, one tenant cannot read another tenant's rows.
• Document parsing runs on Docsfra's own GPU infrastructure by default. Page images are never sent to third-party AI providers; only extracted text reaches model lanes, and only for the AI modules you enable.
• All traffic is encrypted in transit (TLS, automatically managed certificates).
• API access is authenticated with per-tenant API keys and per-tenant rate limits.
• Webhooks are HMAC-signed so your systems can verify every delivery.
• Bring-your-own-key (BYOK) provider credentials are stored encrypted at rest.
• Internal operational tools are not exposed publicly (VPN/internal network only).

Data lifecycle

• Billing runs on an append-only ledger — usage history cannot be silently rewritten.
• Raw uploaded media is subject to scheduled retention sweeps; deletion timestamps are recorded.
• Daily database backups are shipped offsite to a separate provider.

Sovereign deployment

For regulated workloads, Docsfra can run self-hosted or fully air-gapped in your own infrastructure, GPU included — nothing leaves your network. Contact sales@docsfra.com for details.

Reporting a vulnerability

If you believe you have found a security issue, email security@docsfra.com. We acknowledge reports promptly and ask that you give us reasonable time to remediate before public disclosure.