Security at DocsBat
This page is written in plain language. It is a draft that is being reviewed by a lawyer, and we will update it if anything changes as a result.
You trust us with contracts, signatures and private Word documents. This page explains how we protect them. For the details of how we handle personal information, see the Privacy Policy.
Encryption
- In transit: every connection uses TLS (HTTPS). HSTS tells browsers never to connect without it.
- At rest: the database (MongoDB Atlas) and file storage (Cloudflare R2) encrypt data at rest. Authenticator secrets are also encrypted by the application.
Account protection
- Passwords are hashed with scrypt and a unique salt, and are never stored or logged in plain text.
- Two-factor authentication: turn it on in Account settings to ask for a code from an authenticator app at every sign-in. Ten single use recovery codes, stored only as hashes, keep you from being locked out. Code attempts are rate limited.
- Sessions use random, signed, HttpOnly cookies. Changing or resetting your password signs out every other session.
- Sign-in, password reset and code entry are rate limited per network and per account.
- API keys are shown once and stored only as hashes. You can revoke them at any time.
Documents and e-signatures
- Every file, envelope, template and share link is checked against its owner on each request.
- Guest uploads are processed in memory and deleted when processing ends.
- Signing links are long random tokens, unique to each signer.
- Completed envelopes record a full audit trail and are sealed with a PKCS#7 digital signature and SHA-256 hashes, so any later change can be detected.
- Files are processed in isolated worker threads with size, page and time limits.
Application security
- A strict Content Security Policy, frame protection and other hardening headers on every page.
- Cross site request protection on every request that changes data.
- Outgoing requests to addresses you provide, such as webhooks, are checked so they cannot reach private networks.
- Error messages never include internal details, and logs never contain passwords, tokens or document content.
Operations
- Production access is limited to a small number of people, and admin accounts are expected to use two-factor authentication.
- Dependencies are kept up to date and checked for known vulnerabilities.
- Backups are stored with encryption at rest and age out on a rolling schedule.
- Our providers (Fly.io, MongoDB Atlas, Cloudflare, Resend and Stripe) maintain their own security certifications.
Report a vulnerability
If you find a security issue, email [email protected] with the steps to reproduce it. Please do not access other people's data, run denial of service tests or send spam, and give us reasonable time to fix the issue before you share it. We reply within 3 business days.