Security
Your clients trust you with sensitive paperwork. Here is how DocRally protects it. Questions? Email support@docrally.com.
Encryption
- All traffic uses HTTPS (TLS).
- Files are stored in encrypted object storage and given random, unguessable names.
- Downloads use signed links that expire after a few minutes.
Access control
- Each organization's data is isolated; every database query is scoped to your organization.
- Client links contain 256 bits of randomness and only open the single request they belong to.
- Team roles (owner, admin, member) control who can manage billing and the team.
Accounts
- Passwords are hashed with scrypt and never stored in plain text.
- Sessions are stored server-side, can be revoked, and expire automatically.
- Login, sign-up and password reset are rate-limited to stop guessing attacks.
- Resetting a password signs the account out everywhere.
AI document checks
- Only the uploaded file and the name of the requested item are sent for analysis.
- Results never repeat account numbers, tax IDs or other personal identifiers.
- Our AI provider does not use API data to train its models.
Operations
- Payments are handled by a PCI-compliant merchant of record; we never see card numbers.
- Errors are logged and monitored, with sensitive fields redacted.
- You can delete requests, clients and files at any time.