All data is encrypted in transit and at rest using industry-leading standards. Information is collected through a privacy-first approach with strict access permissions.
SOC 2 TYPE II
Completed
GOOGLE CASA
In Compliance
HIPAA
In progress
Compliance & security assessments
We use independent assessments and structured compliance initiatives to evaluate and strengthen our security practices.
GrabDocs has completed a SOC 2 Type II examination covering all five Trust Services Criteria.
Trust Services Criteria
Authorized customers and prospective customers may request the report through our Trust Center.
Request report →GrabDocs completed a CASA Assurance Level 1 (AL1) assessment against CASA specification v2.1.1. The independent grey-box assessment by TAC Security resulted in a verdict of In Compliance.
See the Trust Center for available documentation.
View Trust Center →GrabDocs is currently undergoing a HIPAA-related compliance assessment. We are evaluating the policies, procedures, and safeguards relevant to intended handling of protected health information.
Until that work is complete and agreed in writing, customers should not upload protected health information.
Contact us about HIPAA →GrabDocs is committed to protecting customer data and operating our platform securely. This page provides transparency about our security, privacy, and compliance practices.
GrabDocs helps organizations manage documents, collect information, coordinate business workflows, and work with sensitive business information in one connected workspace. Our security program is designed to support the confidentiality, integrity, and availability of our services.
Documents and business information entrusted to GrabDocs may be sensitive. We encrypt customer data in transit with TLS and at rest using provider encryption, including AES-256 for files in Cloudflare R2 and data in Supabase. Our program includes measures intended to protect information against unauthorized access, disclosure, alteration, and loss.
Access to information and systems is restricted to authorized users and purposes. The product uses account permissions and workspace isolation, including database-level row-level security, so users can reach the information needed for their role and are restricted from information they are not authorized to see. Internal access to user content is limited, monitored, and permitted only when necessary for support, security, legal compliance, or authorized operations.
Our security program includes documented policies and procedures for security operations, risk management, incident response, and business continuity. We monitor dependencies for vulnerabilities, maintain incident notification procedures, and use automated encrypted database backups. If a security incident compromises personal information or user content, we notify affected customers without unreasonable delay.
We handle customer information in accordance with our Privacy Policy and applicable contractual, privacy, and security requirements. GrabDocs does not sell or rent personal information. Individuals may request access, correction, deletion, or a copy of personal data. We retain information only as long as reasonably necessary to provide the service and meet legal or operational obligations.
GrabDocs shares personal data only with service providers needed to run the product, under a data processing agreement or equivalent terms. Providers only receive the access required to perform their services.
AI features search and summarize documents, receipts, and meeting transcripts. Only the document text, transcripts, queries, or excerpts needed for a feature the user requested are sent to OpenAI.
GrabDocs does not use customer data to train its own models and does not intentionally provide customer data to third-party AI providers for training their general models. AI processing is intended to respect existing user permissions. AI-generated output includes a disclaimer and is subject to user review.
Read our AI Policy →Enterprise customers and prospective customers can visit our Trust Center to review available security information and request access to restricted compliance documentation, including our SOC 2 Type II report. Access to confidential documentation may be subject to approval and applicable confidentiality requirements.
Visit Trust CenterLooking for implementation detail? Read the security details or Security FAQ.
For security-related questions, compliance documentation requests, or responsible vulnerability disclosures, contact our security team.
We welcome responsible disclosure from security researchers.
Contact SecurityHow can we help you?
Ask a question about GrabDocs
Submit a support ticket