Security

Built to hold as little of your data as it can.

DocArmor exists to take sensitive information out of documents, so it is designed to keep as little of it as possible, for as short a time as possible. Here is how we protect your documents and your account.

Your documents

Deleted when you're done

Your file and everything made from it are deleted from storage when you finish with it, discard it or sign out, unless you keep it for later review. Anything a closed browser leaves behind is deleted automatically.
A document kept for later review stays until you finish with it or until the time you chose, whichever comes first: at most 72 hours after it's ready, or after the last document in its batch is ready. Signing out or closing the browser doesn't delete it. Finishing with it or Delete now deletes it at once. Owners and Admins can set a shorter limit or turn keeping off.
DocArmor keeps a record of each job, such as its page count and the template used, never the document's contents.
Your documents are never used to train AI models, by us or by our AI provider.
Our logs record counts and timings, never what a document says.

True redaction

Removed, not covered

Redacted text is removed from the file, along with any lines and shapes inside the redaction, rather than hidden under a black box that can be lifted off.
Every redacted page is drawn and checked to confirm that the redacted areas are clean. If DocArmor can't prove it, it turns the page into an image and checks again, and a file with a page it still can't verify is never offered for download.
Metadata, attachments, form field values and the hidden structure behind a tagged PDF are stripped from every redacted file.
Every AI finding goes to a person on your team for review before anything is exported.

Infrastructure

Google Cloud, in the United States

Documents are stored and processed in Google Cloud in the United States, including text recognition and the AI models that find sensitive information.
Data is encrypted in transit and at rest.
Each organization's documents are kept apart, and every request for a file is checked against the organization that owns it.
The service that processes documents can't be reached from the internet. Only DocArmor's application can call it, and it checks the application's credentials on every request.

Accounts and access

The right people, and a record of what they did

Every email address is verified before its account can be used. Sign in with a password or with Google.
A session ends after 30 minutes without activity. Sign-in tokens live in a cookie the page's own scripts can't read, never in browser storage.
Anyone can sign out of every device at once from their profile.
Owners and Admins manage the team and its roles. Users see only the documents they ran. Owners and Admins can also open and review a document a team member kept for later. Only one person reviews a document at a time, and its record names who ran it and who applied the redactions.
An audit log records sign-ins, documents run and downloaded, each opening of a document kept for later, and changes to templates, the team and settings. Owners and Admins can search it and export it.

Compliance

HIPAA, and the paperwork that goes with it

We sign a HIPAA Business Associate Agreement with customers on the Professional and Enterprise plans.
Payments are handled by Stripe. DocArmor never sees your full card number.

Ask about a BAA

Who processes data for us

These companies run parts of DocArmor for us. Only Google Cloud ever handles your documents.

Provider	What they do	Handles your documents
Google Cloud	Hosting, storage, databases, text recognition and the AI models that find sensitive information	Yes
Firebase Authentication, from Google	Sign-in and passwords	No
Stripe	Payments and billing	No
Google Workspace, from Google	Account, billing and document-ready emails, which never name a document or quote it	No

Found a security issue?

If you believe you've found a vulnerability in DocArmor, email us the details. Please don't access other people's data or disrupt the service while you look. We'll confirm that we've received your report and tell you what we find.

[email protected]

Running a security review, or have a questionnaire for us? [email protected]

Test DocArmor on your first document.

Upload a real file: a scan, a fax, or a case record, and see what context-aware redaction catches before you commit. The trial runs 7 days and 20 pages, and needs no credit card.

Try Now Book Demo