Security at docfarm

You share documents through docfarm that are often confidential — proposals, decks, contracts. Here is exactly how we protect them, in plain language.

Viewer access is enforced on the server

Every document lives in a private storage bucket — there are no public file URLs. Content is only served through endpoints that require a signed, expiring token scoped to one specific link and document, minted only after every access gate (password, email verification) has passed on the server. Password gates render zero content until verified: protection is not a client-side overlay.

Uploaded HTML runs isolated from the docfarm application — served from a separate sandbox origin or inside an opaque-origin sandboxed iframe — so a document's scripts can never touch your account, cookies, or other documents.

Certified infrastructure

docfarm runs entirely on infrastructure providers that hold independent security certifications, and inherits their physical, network, and operational controls:

Application security

All traffic is TLS-encrypted with HSTS enforced. Data is encrypted at rest by our storage providers. Authentication uses Google OAuth — we never see or store passwords for your account. Database access is governed by row-level security so every query is scoped to the signed-in owner. Write endpoints are rate-limited, and tracking sessions carry their own tokens so only the browser that started a session can write to it.

Every code change is version-controlled, type-checked and linted in continuous integration before deployment, and dependencies are monitored for known vulnerabilities with automated updates.

Your data, your control

You can delete any document at any time; deletion removes the file, its share links, its viewer analytics, and its chat history. Password protection, email gating, and link revocation are available on every doc. We collect viewer analytics (views, time spent, approximate location) solely to show them to you, the document owner — we do not sell or share this data.

Compliance roadmap

docfarm is an early-stage product and does not yet hold its own SOC 2 attestation or ISO 27001 certificate. Our infrastructure subprocessors do (see above), our technical controls are built to those standards, and formal SOC 2 attestation is on our roadmap as our enterprise usage grows. Happy to complete security questionnaires in the meantime.

Reporting a vulnerability

Found something? Email hello@doc.farm. We acknowledge reports within 48 hours, and good-faith research is welcome — see our disclosure policy.