Privacy and security

Where your documents go, and who can see them

Plain answers about storage, encryption, AI processing, backups and deletion. Where we do not do something yet, we say so.

Operator: Steve Spence, New York, USA · Effective 8 November 2026 · Updated 13 November 2026 (invitations) · Applies to every plan

• Storage
• Encryption
• Who can see it
• AI processing
• Research
• Malware
• Backups
• Accounts
• Other services
• Invitations
• Deletion
• Your rights
• Contact

Where your documents are stored

Document Control runs on a virtual private server we rent from Hostinger, in their data center in Germany. Your original files, every older version, the extracted text and the AI summaries are stored in a PostgreSQL database on that server. The server is used only for our own services; it is not shared hosting.

OCR for scans and photos, and conversion of Word and PowerPoint files to PDF, run in a separate container on the same server (Stirling PDF). Your files are not sent to any outside OCR or conversion service.

Encryption

In transit

All pages, uploads, downloads and answers travel over HTTPS (TLS). The login cookie is marked Secure, so browsers never send it over an unencrypted connection. Calls from our server to Anthropic and Google are also made over HTTPS.

At rest

Passwords are never stored: we keep only a bcrypt hash, which cannot be turned back into the password. Login sessions are stored only as SHA-256 hashes of the session token.

Who can see your documents

• Other organizations: never. Every search, answer, download and change is checked against your organization inside the database itself, not only in the web page. We tested this by trying to read, search, download, change and ask about one test organization's documents from another; every attempt was refused.
• People in your organization: according to their role. Viewers can read and ask; members can also upload, withdraw and restore; admins and owners can also delete permanently.
• Us: as the operator, we have administrator access to the server and database, as any hosting operator does. We do not browse your documents. We look at them only when you ask us to, for example to fix a problem you report, or if the law requires it.
• Hostinger: runs the hardware and has physical and hypervisor access to the server, as with any hosting provider.

What is sent to AI services

Document Control uses Anthropic's Claude API, and only that AI service.

• When you upload: the extracted text (up to about 15,000 characters of it) is sent so Claude can write the title, summary and keywords. Photos, and scans with no readable text, are sent as the image or PDF itself so Claude can read them.
• When you ask a question: your question, the last few messages of the conversation, and the passages from your documents that matched it are sent so Claude can write a cited answer. Your whole library is not sent.

Under Anthropic's commercial terms, they do not use these inputs or outputs to train their models, and they delete them within 30 days. They may keep content longer only if their automated safety systems flag it as a Usage Policy violation, or if the law requires it. See Anthropic: is my data used for training? and Anthropic: how long is data stored?

The Research assistant (Pro and Premium)

Research is included in the Pro plan (5 reports a month) and the Premium plan (10 reports a month). Beta testers are on Pro, so they have it too. When it runs, it sends search queries, never your documents, to the Brave Search API, then writes a text report with links to its sources. It does not download files from the web into your library: what it files is the report it wrote, as a text document. You can withdraw or delete that report like any other document.

Malware and file safety

Each upload is checked by ClamAV, an open-source antivirus engine running in its own container on our server, before anything is saved. Its virus definitions update automatically several times a day. An infected file is refused and nothing is stored. If the scanner is unavailable, uploads are refused until it is back, rather than accepted unscanned. Files never leave our server to be scanned.

No scanner catches everything, so the other protections stay in place. Files are only ever downloaded by people in the organization that uploaded them. Each upload is fingerprinted (SHA-256). Documents are shown in a built-in PDF viewer that does not run scripts embedded in files. OCR and conversion run in an isolated container. Treat downloads as you would any file from a colleague.

Backups

• Server snapshot: Hostinger takes a nightly backup of the whole server and keeps it on their schedule. Like the live server, this copy is not separately encrypted; it is held by the same company that hosts the server.
• Off-site copy: every night, new files and a snapshot of the library (documents, versions, organizations and accounts) are copied to a private Google Drive folder that only Steve Spence can access. Each file is encrypted (OpenPGP, AES-256) on our server before it is uploaded, using a key whose private half is kept offline, never on the server or in Google. Google stores only scrambled data it cannot read, and someone who broke into the server could not read past backups either. Password hashes are not included.

Backups exist so a server failure does not lose your library. They are not used for anything else.

Accounts, logins and cookies

• Logging in sets one cookie, dc_session, which keeps you logged in for up to 14 days. It is HttpOnly (page scripts cannot read it) and Secure. Logging out ends the session on the server.
• After 5 failed logins in 15 minutes, that account is locked for 15 minutes.
• We record login attempts (email, time, success, IP address) to detect attacks.
• There are no analytics, advertising or tracking cookies, and the public pages load no third-party scripts.
• Our automation platform does not keep logs of logins, password changes, signups or successful web uploads. Failed operations are logged for troubleshooting and may contain part of the request.

Other services we use

We do not sell, rent or share your data with anyone else, and we do not use it for advertising.

Invitations

When you use Invite someone, we store the email address you enter, your note if you add one, and who sent it. We send that person one invitation email from steve@kk4hfj.com, with replies going to you. They hear from us again only if you send a reminder, at most once a day. We never add them to a mailing list, and an unused invitation expires after 90 days.

If they create an account with that address, you can see whether they signed up and whether they subscribed, because that decides your organization's free month. You never see their documents or anything else about their account. If you were invited and want the invitation removed, email steve@kk4hfj.com.

Deleting your data

• A document: an admin or owner can delete it permanently from the document's page. It is removed from the live database immediately.
• Your whole account: the owner emails us to close the organization. Closing signs everyone out at once. 30 days later, unless you ask us to reopen it, an automatic nightly job permanently deletes the organization, its documents, versions, users and usage records. If you have a paid plan, cancel it under Plan and billing first: an organization that is still being billed is not deleted.
• Backups: the off-site copies of a document you delete are removed 30 days after you delete it, so a mistake can still be recovered. When an organization is deleted, its off-site copies are removed the same night. The nightly library snapshots, which hold records but no files, are each kept for 30 days. Server snapshots age out on Hostinger's schedule.
• Payment records: Stripe keeps its own records of payments and refunds for as long as the law requires.
• At the end of the beta: accounts without a paid plan move to the Free plan. Nothing is deleted.

Your rights

You can ask us at any time for a copy of your data, to correct it, or to delete it. You can also download any of your files yourself, at any time. Because our server is in the European Union, we aim to meet the GDPR's standards for everyone, wherever you live. We will answer requests within 30 days.

Document Control is for adults: you must be 18 or older to use it.

Changes and contact

If we change how your data is handled, we will update this page and its effective date, and email active users about significant changes before they take effect.

Questions, requests or security reports: steve@kk4hfj.com (Steve Spence, the individual who runs Document Control).