Security

Documents are stored privately and only accessible through authenticated, owner-scoped access.

Database policies restrict users to their own records.

TLS in transit. Storage protections provided by the underlying cloud/storage provider.

The browser only ever uses a publishable key. Service-role keys never leave the server.

Admin actions are gated by a separate roles table — never by client-side claims.

Uploaded documents are processed by AI service providers to generate your report.