Security & trust

Every table that holds tenant data — forms, submissions, clients, comments — is protected by Postgres Row Level Security (RLS), enforced by the database itself, not just the application code. A company's users can only read and write rows scoped to that company.

The application layer adds a second, independent barrier: the current company is always resolved server-side from the authenticated session in the data-access layer, never accepted as client input, so a request cannot ask for another tenant's data even by mistake.

Sign-in is passwordless. Company users and clients receive single-use magic links delivered by email; there is no password database that could leak. Links use hashed, single-use tokens verified server-side, not the raw action link, and sessions are held in secure, httpOnly cookies.

Application data, files, and authentication run on Supabase (managed Postgres, Storage, and Auth) in the eu-central-1 (Frankfurt) region. The web application is served from Vercel's global edge network.

We do not choose infrastructure providers that store production tenant data outside the EU.

All traffic to docucollect.app is served over HTTPS/TLS. Uploaded files are downloaded through authenticated server routes tied to the requester's session and tenant, not shareable public links. Data at rest in Supabase Postgres and Storage is encrypted by the underlying managed infrastructure.

We keep the list of companies that touch tenant data short: Supabase for database, file storage, and authentication (EU), Brevo for transactional email (magic links, invitations, reminders), and Vercel for application hosting. Full detail on purposes and legal bases is in our privacy policy.

DocuCollect is designed around RGPD/GDPR principles: EU data residency, data minimization, and documented data-subject rights (access, rectification, erasure, portability) handled at contact@vivflow.com. See our privacy policy for the full legal basis and retention details.

If you believe you have found a security vulnerability in DocuCollect, email contact@vivflow.com with steps to reproduce. We investigate every report and will acknowledge receipt.