Security
Your documents remain yours
The documents you analyze hold sensitive data. Here is where they are hosted, who can access them and what we will never do with them.
The essentials
- Hosting in the European Union: the application, its databases and your documents are hosted by Amazon Web Services in Ireland.
- Your documents do not train our models: neither your documents nor their analysis results are used to train, test, tune or improve our analysis models.
- Encryption: connections are encrypted (HTTPS), and so is stored data.
- A processor, not an owner: for the content of your documents, your organization remains the data controller; Docusan acts as a processor.
- You stay in control: you delete your documents whenever you want, and an organization’s owner can delete it with everything it holds.
Who can access what
Each document belongs to an organization, and an organization never sees another’s. Within an organization, roles limit access: an analyst only sees the documents they uploaded, while owners, admins and viewers see those of the organization.
On Docusan’s side, access to data follows the principle of least privilege. We may need to view a document and its results to answer a support request: we say so clearly in our privacy policy.
In doubt about a document?
Analyze it for free: Docusan flags the anomalies and locates them on the document.
Sign-in and API keys
- Protected sign-in: with a password or a one-time code sent by email, and an optional authenticator app. Passwords are only stored as a hash.
- Protected administration: administering the service, on Docusan’s side, requires two-factor authentication.
- API keys: they are only stored as a hash, their lifetime is chosen at creation, and their last use is shown. They belong to one organization and only reach its documents and reports.
- Payment: card data is collected and stored by Stripe. Docusan never has access to a card’s full details.
How long is your data kept?
Your documents and their analysis results are deleted after 180 days, or earlier if you delete them yourself; a different period can be agreed for your organization. Invoices are kept for ten years, as the law requires. The other periods are detailed in our privacy policy.
Our sub-processors
We sell no personal data. Only these providers are involved, each within the limits of its role:
- Amazon Web Services EMEA SARL (Luxembourg): hosting in the European Union (Ireland), sending and receiving emails.
- Stripe Payments Europe, Limited (Ireland): payment, invoicing and tax calculation.
- Cloudflare, Inc. (United States): bot check on the free trial.
- Google Ireland Limited (Ireland): analytics for this website, only if you consent.
Some of these providers, or companies in their groups, may process data outside the European Union, notably in the United States, with the safeguards set by the GDPR. The details are in our privacy policy.
Stronger requirements?
The Enterprise plan offers dedicated infrastructure and a contract suited to your constraints. For any security question, or to report a vulnerability, write to security@docusan.com. Requests about personal data go to privacy@docusan.com.
FAQ
Your questions
Where are my documents hosted?
In the European Union, in Ireland, with Amazon Web Services.
Are my documents used to train your models?
No. Neither your documents, nor those sent through the free trial, nor their analysis results are used to train, test, tune or improve our models.
Can I delete my documents?
Yes, at any time from the application. An organization’s owner can also delete it with its documents, reports, accounts and API keys. These actions cannot be undone.
Does Docusan decide for me?
No. The results are automated indications to support a decision: the decision always stays with your teams.
High volumes?
Automate your checks
A subscription with included pages from the Pro plan; the API, dedicated infrastructure and customized detectors with the Enterprise plan.