Security overview

How your records are protected.

Documents are stored privately and served only through short-lived signed links after a permission check. Every record is isolated per organization with database row-level security. Employees see only their own records. Invitation, upload, and report-share links use expiring, revocable tokens stored only as hashes.

We never collect Social Security numbers, criminal-history detail, or child/family records. See the full security page for more.