How does ASHDOCS handle customer data?
ASHDOCS encrypts data in transit (TLS 1.2+) and at rest (AES-256). Source PDFs can be discarded per-request or account-wide with zero-retention mode. Every uploaded file is scanned by ClamAV before processing. Read on for the specifics.
How is data encrypted at ASHDOCS?
All traffic uses TLS 1.2 or higher; HSTS is enforced on the API and the console. Stored objects in Cloudflare R2 are encrypted server-side with AES-256. Fernet encryption is applied to third-party OAuth tokens (Google Drive) and destination credentials (S3 access keys) before they touch the database.
How does zero-retention mode work?
Set options.retention="zero" per request or toggle the account-wide switch in the dashboard. Confidence and delivery metadata are still returned inline for observability; the source PDF and the extracted result are never persisted. A background purge sweeps zero-retention job records every 10 minutes.
What virus and SSRF protections are in place?
Every uploaded file passes through ClamAV before any tool runs. Any URL-fetching endpoint (url-to-pdf, destinations) is guarded against SSRF: RFC1918 ranges, loopback, link-local, cloud metadata endpoints (169.254.169.254 et al.), and IPv6 private ranges are all refused with HTTP 400 detail.code=ssrf_blocked.
How do webhooks and destinations stay tamper-evident?
Every outgoing webhook is signed with HMAC-SHA256 in the X-ASHDOCS-Signature header. Verify with the shared secret from the dashboard; ignore requests that don't match. Delivery is retried three times with exponential backoff; every attempt is logged on the Deliveries page.
What compliance certifications do you have?
None yet — and we won't claim badges we haven't earned. ASHDOCS does not currently hold SOC 2 or ISO 27001 certification. What we offer today: the concrete technical controls documented on this page, a data processing agreement for business customers, and zero-retention mode so your documents never persist on our infrastructure at all.
How do I report a security issue?
Email security@ashdocs.com. Please include reproduction steps and a proposed severity. We acknowledge within 24 hours and do not pursue action against good-faith researchers.