Security

Your clients trust you with their documents. Here's how we protect them.

zendoc is built for firms that handle sensitive client files every day. This page describes exactly what we do — concrete mechanisms, not badges — so you can evaluate us honestly.

How your documents are protected

  • All traffic is served over HTTPS with a strict security-header policy (HSTS, CSP, frame denial, content-type protection).
  • Documents are encrypted at rest in Cloudflare R2 object storage; application data lives in Convex. Both providers maintain their own compliance programs.
  • Every file is scoped to your workspace. Role-based access controls determine which team members can see client documents.
  • Before opening a protected Portal link, a client signs in to a Customer account with a verified email matching your Client record. The link limits access to the work it names, and submissions through it — uploads, form answers, signatures — are recorded against that client record. Opening or downloading a file is not recorded yet.

Accountability and audit

  • Every signed PDF prints its event log: the time, IP address and browser of each event, field by field. The PDF is sealed, so a later change to the file shows.
  • Workspace activity is logged — uploads, reviews, sends, and settings changes are attributable to a person and a time.
  • When a member of your team opens or downloads a file, that is logged too, with the person and the time.
  • Nothing is hard-deleted by day-to-day use: deletions are soft and preserved for audit until purged.

How the AI handles your data

  • zendoc's document review runs on Anthropic's Claude models via API. API inputs are not used to train Anthropic's models.
  • We do not train models on your documents. Ever.
  • AI review is suggestion-only: it flags potential issues (wrong document type, illegible scans, missing pages) for your staff to review. It does not reject client submissions on its own, and nothing AI-drafted reaches a client without a human sending it.
  • AI usage is metered per workspace; subscribed firms pay in credits.

Authentication and account security

  • WorkOS handles team and Customer account sign-in. A Customer account does not grant team access; a protected Portal link also requires a verified email matching the Client record.
  • Outbound messaging honors suppression lists and SMS STOP/START compliance out of the box.

What we don't claim

  • We are not yet SOC 2 certified — that program starts once our first firms are live, and we'd rather tell you that plainly than imply otherwise.
  • Our DPA is published at /dpa and our subprocessors at /subprocessors — read them before you ask. Security questionnaires and data-residency specifics still come back from a human, usually same-day.

Questions before a pilot?

Start with the two documents your reviewer will ask for: zendoc.ai/dpa and zendoc.ai/subprocessors. Anything they don't answer goes straight to the founder: security@zendoc.ai.