Security

What is stored

During a conversion we keep an encrypted blob of the parsed rows, plus a database row with an id, page count, status, a guessed institution name, a filename hash, and expiry times. We do not keep the PDF. We do not keep raw IP addresses; the free-tier limit uses a hash of the IP and a device cookie.

For how long

The encrypted rows expire within one hour of upload. After the first download they are deleted within 15 minutes. A cron route runs every 15 minutes and removes anything past its expiry. Account metadata stays until you delete the account.

Subprocessors

• Vercel, if you deploy there, runs the application.
• Supabase, if configured, stores the database and the private file bucket. Local development uses a SQLite file and disk instead.
• Stripe processes checkout and the customer portal. Only test keys are accepted.
• Resend, if EMAIL_FROM and RESEND_API_KEY are set in production, sends the magic-link email. Development does not send mail.
• An OCR provider (Google Gemini or Amazon Textract) runs only when OCR_PROVIDER and its key are set. Otherwise scanned PDFs are declined.
• Plausible, if NEXT_PUBLIC_PLAUSIBLE_DOMAIN is set, receives a cookieless page view. It is omitted when unset.

What this is not

This page describes how the product is designed. It is not a certification, an audit, or a claim of compliance with a named security standard.