How Documirea handles files
This page describes the current staging prototype, not a complete commercial privacy policy. We are still implementing and auditing security and data handling.
What happens when you upload a document?
- Your browser sends the file to Documirea's server over HTTPS.
- A temporary document-processing subprocess handles the upload and returns a processed file or preview.
- Files can be held in application memory and can temporarily spool to disk during multipart processing. Temporary files are placed in a private per-job directory when used.
- The parent process attempts to remove that job directory after completion, errors or a timed-out worker. This is not a guarantee of secure erasure or audited deletion.
- The app does not intentionally save uploaded documents in a long-term document library or account in this prototype.
What remains in your browser?
The editor can retain the selected file, page previews and changes in your browser tab while it is open. Use New document to clear the editor, or close the tab when finished. Browser and device behaviour may vary.
Logs and hosting
Infrastructure services may process or retain network and operational metadata, including IP addresses, connection timestamps and errors. We have not completed a full audit of the hosting provider's logging, backups or retention. We do not guarantee that every temporary copy can be irreversibly erased.
Malware scanning and security
The application contains an optional ClamAV scanning integration, but antivirus scanning is not enabled on the current free staging service. Child processes are bounded but do not provide hardened sandbox isolation. Check the current configuration using the public security status endpoint.
Accounts and Stripe test billing
When customer accounts are enabled, Supabase Auth handles registration, verification emails and sign-in. The browser temporarily keeps access and refresh tokens in session storage, scoped to the tab. The private billing database links the verified account identifier to Stripe test customer and subscription identifiers. Stripe hosts the payment and subscription-management pages. Documirea does not collect payment card numbers or store passwords in its billing tables.
Account records, Stripe events, authentication logs and subscription metadata may be retained by those services. Their deletion, retention, account recovery, regulatory notices and production service agreements have not yet been fully audited. No live payments are enabled.
Commercial use
Documirea is a development preview. An independently reviewed privacy policy, secure processing architecture, audited deletion procedures, malware scanning, licensing review and security assessment are required before accepting customers' private documents.