Security First

Industry-Standard Encryption

• Encrypted at rest -- all documents, parsed data, and database records are encrypted via Supabase on AWS infrastructure, using industry-standard encryption.
• Encrypted in transit -- all communication between your browser and our servers is encrypted via TLS, enforced by our hosting and database providers.
• Stripe PCI DSS Level 1 -- payment processing handled by Stripe, the most widely trusted payment provider for SaaS.

Complete Data Isolation

• Row Level Security (RLS) -- every request is scoped to your organization by database policies and by organization checks in the application, so one organization cannot see another's data.
• Role-Based Access Control -- roles from Owner and Admin to Viewer, with permissions per action, ensure team members only access what their role permits.
• Audit trail -- key actions are logged with timestamp, user, and details. Available for compliance reviews and regulatory audits.

AI Data Sovereignty

• Your data is never used to train AI models. Documents read by the checks and the AI assistant are used only to produce your results.
• AI provider -- data sent through OpenAI's API is not used to train their models, under OpenAI's API data usage policy. Social Security numbers and full account and card numbers are removed from document text before it is sent to the AI provider. OpenAI may keep API data for up to 30 days for abuse monitoring; every request asks it not to store the exchange, and document text is treated as data, never as instructions. A W-2 or 1099 keeps only the last 4 digits of its SSN, EIN and TIN.
• Prompt versioning -- every fraud analysis run records the exact AI prompt version used, enabling full auditability and reproducibility.

Infrastructure

• Supabase (SOC 2 Type II) -- database, authentication, and file storage on AWS infrastructure.
• Vercel Edge Network -- application delivered via global CDN with DDoS protection and automatic SSL.
• CI/CD pipeline -- automated testing, type checking, and build verification on every deployment. Error tracking and monitoring planned for production release.

Subprocessors

The services that receive your organization's data, and what for:

• Supabase: database, sign-in and file storage, on AWS.
• Vercel: hosting the application.
• OpenAI: reading the figures in document text, with SSNs and account numbers removed first, and answering AI assistant questions.
• Stripe: payments. Card details go to Stripe, never to FixDoc.
• Resend: sending email notifications.

Scans and photos are read by OCR on FixDoc's own servers; no image is sent to an AI provider.

How long files are kept

Lenders and brokers must keep loan records for set periods (for example 25 months under Regulation B and up to 5 years under Regulation Z), so FixDoc never deletes a loan file on its own. A removed document is kept for 5 years and can be restored by an admin. A setting for each organization to choose its own retention period is planned.