1. Encryption
All traffic between your browser and DocChat is encrypted with TLS 1.2+. Documents and sensitive fields are encrypted at rest with AES-256-GCM using keys held in AWS KMS. Passwords are hashed with bcrypt (cost factor 12) — we could not show you your password even if we wanted to.
2. Infrastructure
DocChat runs on AWS in the Asia-Pacific (Singapore) region. We use:
- EC2 for compute, behind an Application Load Balancer with WAF rules
- S3 for file storage with versioning + server-side encryption
- Neon (managed Postgres) with point-in-time recovery and read-only branches for staging
- Private subnets for all stateful services, accessed only through bastion hosts with MFA
3. Access control
Only named engineers can access production. All access is through SSO with hardware-key MFA. Every production action is logged to an append-only audit trail. We follow the principle of least privilege — no one has standing access to customer data.
4. Application security
- Strict Content-Security-Policy headers on every response
- CSRF tokens on every state-changing request
- Rate limiting on auth and upload endpoints
- Per-user data isolation at the database query level
- Automated dependency scanning and weekly patch rollouts
5. AI provider isolation
When we send a chunk of your document to an LLM provider to answer your question, we send only the relevant snippet — never your full document, account info, or other users' data. All providers we use have signed data processing agreements that prohibit training on your data.
6. Backups
Databases are backed up continuously with 30-day point-in-time recovery. File storage is versioned. We run disaster-recovery drills quarterly.
7. Compliance
DocChat is built to align with SOC 2 Type II, GDPR, and is HIPAA-ready for Enterprise customers under a signed BAA. A summary of our latest audit is available to customers under NDA — email security@docchat.app.
8. Responsible disclosure
If you find a security issue, please report it to security@docchat.app instead of disclosing it publicly. We commit to:
- Acknowledging your report within 48 hours
- Providing a triage update within 5 business days
- Crediting you in our security hall of fame (if you'd like)
- Paying a bounty for high-impact issues, scaled to severity
Please don't perform DoS attacks, social-engineer our staff, or access data that isn't yours.
9. Incident response
We have a documented incident-response plan. In the event of a breach that affects your data we will notify you within 72 hours of confirmation, along with what happened, what data was involved, and what we're doing about it.