This is the detailed technical security page. View the Security & Trust page →

GrabDocs Security Details

Security is at the core of everything we build at GrabDocs.

Businesses trust us with their most important financial, operational, and personal documents — and we design our systems to protect that data at every layer.

This page summarizes how we protect customer data across infrastructure, encryption, access controls, and operational practices.

View Security FAQ → | Visit Trust Center →

Assessments

  • SOC 2 Type II — Completed. The examination covers all five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
  • Google CASA AL1 — In Compliance. Independent grey-box assessment by TAC Security against CASA specification v2.1.1.
  • HIPAA — Assessment in progress. Do not upload protected health information unless GrabDocs has agreed in writing.

Restricted reports are available through the Trust Center.

Infrastructure Security

GrabDocs is built on a modern, secure cloud stack:

Cloudflare

  • Cloudflare R2 stores documents using AES-256 encryption at rest.
  • Cloudflare automatically enforces TLS 1.2/1.3 encryption for all traffic.
  • Global CDN and DDoS protection helps ensure service reliability and security.
  • Zero-Trust tools help enforce secure access to internal services.

Supabase

  • Supabase provides our managed PostgreSQL database.
  • Data is encrypted at rest using the underlying infrastructure's encryption (AES-256).
  • Supabase uses secure, encrypted connections (TLS) for all in-transit database communication.
  • Row-level security (RLS) ensures strict data isolation between users and companies.

Application Hosting

  • Our application services run in secure, containerized environments on enterprise-grade cloud infrastructure.
  • Secrets are stored using encrypted secret management systems.
  • Automatic HTTPS is enforced (TLS 1.2/1.3).
  • Cloud-provider–level encryption protects storage volumes and backups.

Encryption

Data in Transit

All communication between browsers, our API, and third-party services is encrypted via TLS 1.2/1.3.

Data at Rest

All stored data — documents, metadata, logs — is encrypted at rest using:

  • AES-256 (Cloudflare R2)
  • AES-256 (Supabase Postgres)
  • Provider-level encryption (Render disks)

Application-Level Encryption (Optional Feature)

For sensitive document storage, GrabDocs uses optional application-layer encryption:

  • Files are encrypted using AES-256-GCM before they are uploaded.
  • Only the GrabDocs backend can decrypt files.
  • Cloudflare and Supabase only store encrypted blobs, not readable files.
  • This prevents anyone, including platform staff, from reading customer documents.

Access Control & Privacy

Role-Based Access Control (RBAC)

Granular permissions control:

  • who can upload documents
  • who can view, edit, or delete
  • who can manage billing
  • who can create workspaces
  • who can manage team members

Workspace & Company Isolation

Each organization, workspace, and individual user is completely isolated:

  • No cross-tenant data access
  • Strict database-level RLS enforcement
  • Isolated encryption keys where applicable

2-Factor Authentication (2FA)

Built-in 2FA secures all account access by default.

No-Engineer-Access Policy

GrabDocs implements a strict No-Engineer-Access model:

  • Engineers do not have access to customer documents or database contents.
  • Application-layer encryption ensures that even administrators cannot view document contents, because only encrypted blobs are stored.
  • When support is required, engineers may only view:
    • metadata
    • system logs
    • error traces
  • Never document content.
  • All access is logged and monitored.

Audit Logs & Versioning

GrabDocs supports detailed logging of:

  • document uploads
  • document views
  • permission changes
  • user login events
  • admin actions

Backups & Reliability

  • Supabase provides automated, encrypted database backups.
  • Cloudflare R2 provides durable object storage with multiple-region redundancy.
  • Our hosting infrastructure supports service redundancy and automatic restarts.
  • GrabDocs performs daily internal backups of critical metadata.
  • Backups are encrypted at rest.

AI Safety & Privacy

GrabDocs uses AI to help users search and understand their documents, with strict boundaries:

  • Only the document text, transcripts, queries, or excerpts needed for a requested feature are sent to the AI provider.
  • GrabDocs does not use customer data to train its own models.
  • GrabDocs does not intentionally provide customer data to third-party AI providers for training their general models.
  • AI processing is intended to respect existing user permissions. AI-generated output is subject to user review.

Read our AI Policy

Privacy Policy & Terms

GrabDocs publishes a clear Privacy Policy and Terms of Service outlining:

  • What data we collect
  • How we use your data
  • Security commitments
  • Customer rights

View our Privacy Policy | View our Terms of Service

Summary

GrabDocs uses industry-standard security practices including:

  • AES-256 encryption at rest
  • TLS 1.2/1.3 encryption in transit
  • Role-based access control
  • Company-level data isolation
  • No-ENGINEER-ACCESS enforcement
  • Encrypted backups
  • Zero-trust principles
  • Modern cloud infrastructure (Cloudflare, Supabase)
  • Scoped AI processing

Security is not a feature — it's the foundation of our product.

Have Questions?

Check out our Security FAQ, or contact [email protected].

View Security FAQ