Passports and tax returns, handled properly.

Encrypted before storage

Each file gets a fresh AES-256-GCM key. That key is wrapped with an RSA-OAEP public key; the private key never leaves the server. The storage layer only ever holds ciphertext — a breach of the bucket yields nothing readable.

Private, expiring links

A client link is an RS256-signed token scoped to one client, with a database-backed id so it can be revoked instantly. It expires (14 days by default) and is upload-only — there is no route that reads a file with a client token.

Tenant-scoped access

Every client belongs to one account. File downloads join through that ownership check, so one firm can never reach another’s documents, and an unauthenticated request is refused.

Append-only audit log

Every upload, AI verdict, reassignment, manual override and reminder is written to a timestamped log. You can show why a document was accepted, not just that it was.

Hardened by default

Uploads are allow-listed by byte signature, size-capped and rate-limited per link and per IP. Strict security headers, a nonce-based Content-Security-Policy, and HTTPS-only transport. Built against the OWASP Top 10.

Key handling

Signing and encryption keys are separate key pairs with separate blast radius. For a production deployment they live in the platform’s secret store or a vault, never in the codebase or logs.