Security & data processing
What happens to a document you send us
This page exists because "we take security seriously" is not an answer. Below is the actual path a file takes, what is kept, for how long, and who else touches it — written for the person inside your organisation who has to approve sending us files.
The short version. Your document is processed in memory and sent to a third-party AI model provider over TLS for text extraction. We do not keep a copy of the files you upload. The resulting spreadsheet is held in a temporary directory and deleted on a timer measured in minutes. Our database holds your account, credit balance, payment records and usage events — never document content.
The full path
- Upload. The file is received over TLS and held in memory, subject to a size limit. No copy of the original is kept — except that when the result screen shows a row of your original next to a number the arithmetic check flagged, that small image crop is held in memory with the preview and expires with it; it is never written to disk.
- Preparation. Images are resized to reduce what leaves our server. Multi-page PDFs are rendered to page images inside a private temporary directory (owner-only permissions) which is deleted before the request finishes — success or failure.
- Extraction. The page image and a fixed instruction prompt are sent over TLS to the model provider (see sub-processors). This is the one point at which document content leaves our infrastructure.
- Preview. The extracted text and table structure are held in memory only, scoped to your account, and expire on a short timer. They do not survive a server restart and are never written to the database.
- Grouping (multi-file jobs). When several files are converted together, a second model call decides which of them belong in the same output file. This call receives text only — never images. That is enforced by an automated test that fails the build if image data appears in the payload.
- Export. The Excel or Word file is written to a temporary directory, served to you once, and deleted shortly afterwards. That directory is also wiped in full every time the server process starts.
What is stored permanently
Four tables. This is the complete list.
| Table | Contents |
|---|---|
users | Account id, Firebase user id, email address, display name, credit balances, terms-acceptance timestamp. |
credit_ledger | One row per credit movement: scan, purchase, refund. Used for billing accuracy and dispute resolution. |
payments | Payment provider, transaction id, amount, credits granted. No card data — we never see or hold card details. |
user_events | One row per sign-in, scan and download: time, IP address, country, browser and device type, timezone, and scan metadata (file type and size, model used, error, number of rows extracted). Used to prevent abuse of free credits and to find failing scans. |
No table holds document content, extracted values, or uploaded filenames. Server logs record technical metadata only — timestamps, error codes, request sizes, model token counts.
Sub-processors
Parties that may process data on our behalf. AI model providers are listed by category; the named list is provided with any data processing agreement we sign.
| Party | Purpose | Receives document content? |
|---|---|---|
| AI model providers (vision and language APIs) | Text and table extraction from page images | Yes — page images |
| Google Firebase | Sign-in and account verification email | No — email address only |
| PayPal | Payment processing | No |
| Cloudflare | DNS and edge delivery | No — traffic metadata only |
| Google Analytics 4 | Usage analytics, consent-gated | No |
| Microsoft Clarity | Session replay and heatmaps of how the page is used, consent-gated | No — results, file names and inputs are masked |
Third-party analytics defaults to denied under Consent Mode v2
until you accept. Independently of that choice, our own server counts page views and the
steps before sign-in (opening the app, selecting files, the sign-in window) with an
identifier that changes every day — no cookie, no IP address and no account attached.
The one cookie we set is dt_guest, when you scan a page without an account: a
random identifier with no personal data, used only to limit free guest scans to 1 page per day.
What we do not do
- We do not use your documents to train any model.
- We do not sell, rent or share your documents with anyone outside the list above.
- We do not keep your documents after processing.
- We never see, store or handle payment card details.
Model providers process data under their own terms. Where a provider offers a zero-retention or no-training tier, we will state in writing which one your account runs under — ask, and it goes in the agreement.
Data processing agreement
A DPA is available on request, and we will review and sign yours rather than insisting on ours. It states the exact retention windows, the sub-processor list above, breach-notification timelines, and the deletion process.
Email [email protected] with "DPA" in the subject and we will respond with a draft.
Being straight about the limits
A security page that only lists strengths tells you nothing. These are the current limitations, stated plainly so you can decide rather than discover:
- DocTable is a young service. We hold no SOC 2, ISO 27001 or equivalent certification, and we will not imply otherwise.
- We cannot currently guarantee a specific data residency region. Model providers may process data outside your country. If residency is a hard requirement for you, tell us before sending anything.
- We are not set up for regulated health data and do not accept it.
- Output accuracy is not guaranteed. Extracted figures should be verified before use in accounting, customs or financial filings.
Reporting a security issue
Email [email protected]. We will acknowledge within two business days. Please do not publicly disclose an issue before we have had a chance to fix it.