Last updated September 8, 2026
Security Policy
How users and administrators should handle sensitive accounts and documents.
Account security
- Use a strong, unique password and enable authenticator-app two-factor authentication.
- Magic links are one-time login links and should not be forwarded, posted, or shared.
- Log out on shared devices and contact support if you believe your account or email has been compromised.
Document security
- The app is intended to store sensitive consumer-credit, legal, financial, retail, and court documents in private user workspaces.
- Admins may access user documents only for support, maintenance, security, compliance review, or user-requested troubleshooting.
- No online service can guarantee absolute security; avoid uploading documents you are not authorized to store or process.
Operational safeguards
- The app uses signed sessions, CSRF-protected forms, password hashing, environment-based secrets, admin allow-listing, magic-link token hashing, and optional 2FA.
- Security reports and suspected vulnerabilities should be sent through the support contact page.
These policies are practical startup templates for this app. They should be reviewed by qualified counsel before broad public launch, paid subscriptions, or use in additional jurisdictions.