Skip to content
Get started
☰
ProductHow it worksPricingFAQContactLog inGet started
SECURITY & SERVICE SCOPE

Private sharing.
Clear boundaries.

Your business and its client share access to a specific request. Security claims should be backed by controls and tests.

How access works

Business users sign in to their own workspace. Clients use a private request link and a short-lived, one-time email code. Possessing a link alone does not grant access to the checklist or its files. Authorized workspace members can review and download submissions; the verified client can access their own request.

Controls in the application

  • Argon2 password hashing, revocable server-side account sessions and CSRF protection.
  • Optional authenticator-based two-factor sign-in with encrypted setup secrets and single-use recovery codes.
  • Workspace-scoped permission checks and owner controls for billing and team membership.
  • Private Amazon S3 storage with public access blocked, encryption at rest and transport enforcement.
  • File type and size limits, plus malware scanning before accepting an upload. Uploads are blocked when scanning is unavailable.
  • Private downloads with attachment headers, no-store responses and search-engine exclusions for account and request pages.
  • Transactional email through Resend with enforced TLS. Recipients whose mail server cannot support the configured transport policy may not receive messages.

What these controls do not mean

DocDropIt is not end-to-end encrypted: the application must process documents to scan them and provide authorized downloads. Access by the service operator and infrastructure providers is possible as needed to operate and support the service. Malware screening cannot detect every threat, and no system can guarantee that every upload is safe.

Current release limitation: An independent security assessment, production backup/restore validation and applicable compliance review are still outstanding. Use fictional test documents during this early-access period. Do not upload medical records, government IDs, tax documents, financial account information, passwords or other sensitive or regulated information.

Storage and providers

Account and request metadata use Supabase PostgreSQL in Northern Virginia. The application and private scanner run on Render in Virginia. File objects use Amazon S3 in Ohio. Stripe handles payments; Resend sends transactional email; GoDaddy/Microsoft 365 provides support email. See the privacy notice for the processing scope.

Reporting a security concern

Email support@docdropit.com with the subject “Security report.” Share a description and reproduction steps without including real client documents, access codes, passwords or API keys. We will investigate reports; no response-time or resolution guarantee is offered.