Security & data processing
What happens to a document you send us
This page exists because "we take security seriously" is not an answer. Below is the actual path a file takes, what is kept, for how long, and who else touches it — written for the person inside your organisation who has to approve sending us files.
The short version. Your document is processed in memory and sent to a third-party AI model provider over TLS for text extraction. It is never written to persistent storage on our side. The resulting spreadsheet is held in a temporary directory and deleted on a timer measured in minutes. Our database holds your account, credit balance and payment records — never document content.
The full path
- Upload. The file is received over TLS and held in memory, subject to a size limit. It is not written to any permanent location.
- Preparation. Images are resized to reduce what leaves our server. Multi-page PDFs are rendered to page images inside a private temporary directory (owner-only permissions) which is deleted before the request finishes — success or failure.
- Extraction. The page image and a fixed instruction prompt are sent over TLS to the model provider (see sub-processors). This is the one point at which document content leaves our infrastructure.
- Preview. The extracted text and table structure are held in memory only, scoped to your account, and expire on a short timer. They do not survive a server restart and are never written to the database.
- Grouping (multi-file jobs). When several files are converted together, a second model call decides which of them belong in the same output file. This call receives text only — never images. That is enforced by an automated test that fails the build if image data appears in the payload.
- Export. The Excel or Word file is written to a temporary directory, served to you once, and deleted shortly afterwards. That directory is also wiped in full every time the server process starts.
What is stored permanently
Three tables. This is the complete list.
| Table | Contents |
|---|---|
users | Account id, Firebase user id, email address, display name, credit balances, terms-acceptance timestamp. |
credit_ledger | One row per credit movement: scan, purchase, refund. Used for billing accuracy and dispute resolution. |
payments | Payment provider, transaction id, amount, credits granted. No card data — we never see or hold card details. |
No table holds document content, extracted values, or uploaded filenames. Server logs record technical metadata only — timestamps, error codes, request sizes, model token counts.
Sub-processors
Parties that may process data on our behalf. This list is maintained here and is part of any data processing agreement we sign.
| Party | Purpose | Receives document content? |
|---|---|---|
| xAI (Grok) | Text and table extraction — the default model | Yes — page images |
| NVIDIA (hosted models) | Configured as fallback capacity; currently disabled | Only if enabled |
| Google Firebase | Sign-in and account verification email | No — email address only |
| PayPal | Payment processing | No |
| Cloudflare | DNS and edge delivery | No — traffic metadata only |
| Google Analytics 4 | Usage analytics, consent-gated | No |
Analytics defaults to denied under Consent Mode v2 until you accept — nothing is measured before that choice.
What we do not do
- We do not use your documents to train any model.
- We do not sell, rent or share your documents with anyone outside the list above.
- We do not retain your documents after processing — there is nothing to retain, because they are never persisted.
- We never see, store or handle payment card details.
Model providers process data under their own terms. Where a provider offers a zero-retention or no-training tier, we will state in writing which one your account runs under — ask, and it goes in the agreement.
Data processing agreement
A DPA is available on request, and we will review and sign yours rather than insisting on ours. It states the exact retention windows, the sub-processor list above, breach-notification timelines, and the deletion process.
Email [email protected] with "DPA" in the subject and we will respond with a draft.
Being straight about the limits
A security page that only lists strengths tells you nothing. These are the current limitations, stated plainly so you can decide rather than discover:
- DocTable is a young service. We hold no SOC 2, ISO 27001 or equivalent certification, and we will not imply otherwise.
- We cannot currently guarantee a specific data residency region. Model providers may process data outside your country. If residency is a hard requirement for you, tell us before sending anything.
- We are not set up for regulated health data and do not accept it.
- Output accuracy is not guaranteed. Extracted figures should be verified before use in accounting, customs or financial filings.
Reporting a security issue
Email [email protected]. We will acknowledge within two business days. Please do not publicly disclose an issue before we have had a chance to fix it.