Document Vault Security Architecture

Learn how we defend your sensitive business documents, cap tables, and legal agreements.

Logical Row-Level Isolation (RLS)

Access controls are hardcoded directly into the database engine. Every query verifies the authenticated caller's identity (JWT token) on a row-by-row level, ensuring users can never see, search, or download documents belonging to other organizations.

AES-256 Encryption at Rest

All physical files stored in our vaults are automatically encrypted at rest using Advanced Encryption Standard (AES-256). Even in the event of hardware theft or database storage media access, your data remains completely unreadable.

Tokenized Time-Bound Signed URLs

Your files are never exposed through static public URLs. Every time you view or download a document, the platform generates a unique, cryptographically signed link valid for only 60 seconds. Sharing the link with unauthorized parties is useless.

SSL/TLS 1.3 Encryption in Transit

All traffic between your browser and our storage infrastructure is encrypted using SSL/TLS 1.3 protocols. This defends your connections from man-in-the-middle attacks and network eavesdropping.

Frequently Asked Security Questions

Can our platform admins read my files?

No. Platform access permissions are governed by role-based credentials. File downloads are fully audited, and direct storage buckets are logically segregated using isolation rules.

Where are the files hosted?

Documents are hosted on secure, high-redundancy cloud storage clusters managed by our secure infrastructure partner. This configuration complies with standard financial audits and data-segregation requirements.

What happens when I delete a document?

Deletions are permanent. When you delete a folder or file, we trigger a cascade that drops the database indices and physically purges the corresponding binary files from our cloud storage disks.