- Encryption in transit
- All traffic uses TLS.
- Encryption at rest
- Files and records are encrypted at rest by our hosting provider.
- Private storage
- Uploaded files are kept in private storage, in a folder only your account can reach.
- Sign-in on every action
- Every action on a document or Pad requires a signed-in user who owns it or belongs to its workspace. Fill links are the one exception: they work without an account, and each link is a random token you can revoke.
- Roles
- Workspace owners, editors and viewers get different permissions, enforced by the database.
- Audit log
- Uploads, analysis, edits, shares and submissions are recorded with who did them and when.
- Export and deletion
- You can download all of your data, or delete your account and every file and record, from Settings.
- AI processing
- Documents are read by OpenAI to find fields. No agreement covering medical records (BAA) is in place yet.