Privacy and security
Where your documents go, and who can see them
Plain answers about storage, encryption, AI processing, backups and deletion. Where we do not do something yet, we say so.
- Every connection to Document Control uses HTTPS (TLS). Passwords and documents never travel unencrypted.
- Your files live on our own server in a Hostinger data centre in Germany, not on a shared consumer cloud drive.
- Each organisation's documents are walled off from every other organisation, enforced inside the database.
- To write summaries and answers, the relevant text goes to Anthropic's Claude API. Anthropic does not train its models on it and deletes it within 30 days.
- Scanning, OCR and PDF conversion run on our own server. No other AI or document service sees your files.
- No advertising, no analytics trackers, no selling or sharing of your data. One login cookie, nothing else.
- Every upload is virus-scanned on our own server (ClamAV) before it is stored. Infected files are refused.
- Files are not yet encrypted separately at rest inside the database. Details below.
- Storage
- Encryption
- Who can see it
- AI processing
- Research
- Malware
- Backups
- Accounts
- Other services
- Deletion
- Your rights
- Contact
Where your documents are stored
Document Control runs on a virtual private server we rent from Hostinger, in their data centre in Germany. Your original files, every older version, the extracted text and the AI summaries are stored in a PostgreSQL database on that server. The server is used only for our own services; it is not shared hosting.
OCR for scans and photos, and conversion of Word and PowerPoint files to PDF, run in a separate container on the same server (Stirling PDF). Your files are not sent to any outside OCR or conversion service.
Encryption
In transit
All pages, uploads, downloads and answers travel over HTTPS (TLS). The login cookie is marked Secure, so browsers never send it over an unencrypted connection. Calls from our server to Anthropic and Google are also made over HTTPS.
At rest
Passwords are never stored: we keep only a bcrypt hash, which cannot be turned back into the password. Login sessions are stored only as SHA-256 hashes of the session token.
Who can see your documents
- Other organisations: never. Every search, answer, download and change is checked against your organisation inside the database itself, not only in the web page. We tested this by trying to read, search, download, change and ask about one test organisation's documents from another; every attempt was refused.
- People in your organisation: according to their role. Viewers can read and ask; members can also upload, withdraw and restore; admins and owners can also delete permanently.
- Us: as the operator, we have administrator access to the server and database, as any hosting operator does. We do not browse your documents. We look at them only when you ask us to, for example to fix a problem you report, or if the law requires it.
- Hostinger: runs the hardware and has physical and hypervisor access to the server, as with any hosting provider.
What is sent to AI services
Document Control uses Anthropic's Claude API, and only that AI service.
- When you upload: the extracted text (up to about 15,000 characters of it) is sent so Claude can write the title, summary and keywords. Photos, and scans with no readable text, are sent as the image or PDF itself so Claude can read them.
- When you ask a question: your question, the last few messages of the conversation, and the passages from your documents that matched it are sent so Claude can write a cited answer. Your whole library is not sent.
Under Anthropic's commercial terms, they do not use these inputs or outputs to train their models, and they delete them within 30 days. They may keep content longer only if their automated safety systems flag it as a Usage Policy violation, or if the law requires it. See Anthropic: is my data used for training? and Anthropic: how long is data stored?
The Research assistant (Premium)
Research is a Premium feature and is not part of the free beta. When it runs, it sends search queries, never your documents, to the Brave Search API, then writes a text report with links to its sources. It does not download files from the web into your library: what it files is the report it wrote, as a text document. You can withdraw or delete that report like any other document.
Malware and file safety
Each upload is checked by ClamAV, an open-source antivirus engine running in its own container on our server, before anything is saved. Its virus definitions update automatically several times a day. An infected file is refused and nothing is stored. If the scanner is unavailable, uploads are refused until it is back, rather than accepted unscanned. Files never leave our server to be scanned.
No scanner catches everything, so the other protections stay in place. Files are only ever downloaded by people in the organisation that uploaded them. Each upload is fingerprinted (SHA-256). Documents are shown in a built-in PDF viewer that does not run scripts embedded in files. OCR and conversion run in an isolated container. Treat downloads as you would any file from a colleague.
Backups
- Server snapshot: Hostinger takes a nightly backup of the whole server and keeps it on their schedule. Like the live server, this copy is not separately encrypted; it is held by the same company that hosts the server.
- Off-site copy: every night, new files and a snapshot of the register (documents, versions, organisations and accounts) are copied to a private Google Drive folder that only Advanced Research Systems can access. Each file is encrypted (OpenPGP, AES-256) on our server before it is uploaded, using a key whose private half is kept offline, never on the server or in Google. Google stores only scrambled data it cannot read, and someone who broke into the server could not read past backups either. Password hashes are not included.
Backups exist so a server failure does not lose your library. They are not used for anything else.
Accounts, logins and cookies
- Logging in sets one cookie,
dc_session, which keeps you logged in for up to 14 days. It isHttpOnly(page scripts cannot read it) andSecure. Logging out ends the session on the server. - After 5 failed logins in 15 minutes, that account is locked for 15 minutes.
- We record login attempts (email, time, success, IP address) to detect attacks.
- There are no analytics, advertising or tracking cookies, and the public pages load no third-party scripts.
- Our automation platform does not keep logs of logins, password changes, signups or successful web uploads. Failed operations are logged for troubleshooting and may contain part of the request.
Other services we use
| Service | What it does | What it receives |
|---|---|---|
| Hostinger (Germany) | Hosts the server | Everything stored on the server |
| Anthropic Claude API | Summaries and answers | Document text and questions, as described above |
| Google Drive | Nightly off-site backup | Encrypted backup copies of files and the register, which Google cannot read |
| Gmail | Welcome emails to approved testers | Your name, email, organisation name and temporary password |
| Telegram | Notifies us of new beta applications | What you wrote on the application form |
| Brave Search API | Web search for Research (Premium only) | Search queries only |
We do not sell, rent or share your data with anyone else, and we do not use it for advertising. When paid plans launch, payments will be handled by a payment processor; we will never see or store your card number.
Deleting your data
- A document: an admin or owner can delete it permanently from the document's page. It is removed from the live database immediately.
- Your whole account: email us and we will delete your organisation, its documents, versions, users and usage records.
- Backups: deleted files can remain in backups for a while. When you close your account, we remove your files from the off-site backup within 30 days. Server snapshots age out on Hostinger's schedule.
- At the end of the beta: accounts without a paid plan move to the Free plan. Nothing is deleted.
Your rights
You can ask us at any time for a copy of your data, to correct it, or to delete it. You can also download any of your files yourself, at any time. Because our server is in the European Union, we aim to meet the GDPR's standards for everyone, wherever you live. We will answer requests within 30 days.
Document Control is not intended for children under 16.
Changes and contact
If we change how your data is handled, we will update this page and its effective date, and email active users about significant changes before they take effect.
Questions, requests or security reports: greentrust@gmail.com (Advanced Research Systems).