Security

How documents are handled

• In transit, every request and response is encrypted with TLS.
• At rest, documents sit on the object store described on the subprocessors page, which encrypts every stored file with AES-256.
• Model calls (field detection, context fills) go through the model providers described on the subprocessors page.
• Fax delivery goes through the fax carrier described on the subprocessors page. The carrier fetches the document through a link that expires within an hour, the staged copy is deleted within 24 hours, and full destination numbers never appear in logs or receipts. The fax record keeps the full number and the internet address the request came from for 90 days, for abuse limits, refunds and disputes, then masks them.
• Download links need no sign-in and work for anyone who holds them: a link to a finished document expires after 24hours, or about an hour for a page tool's file, and the link the fax carrier fetches after 1 hour.
• Error reports carry a request's method and path only: never its headers, query string, body or internet address.
• API keys are stored hashed, never in plain text.
• A blank form identical to one Emboss has already processed, including copies saved by a different program, reuses that form's field map. The map describes the form: its field names, positions and types, the text printed beside each box and the form's title. It holds nothing about any person or account.

Ephemeral processing

Ephemeral processing: source and output documents are deleted 60 to 70 minutes after the last activity on a form.

Deleted:

• the uploaded form, the fillable copy and the thumbnail
• the supporting documents
• every filled output and batch output, including the values exported from an XFA form
• the session's values, the proposal's evidence and the receipt's values
• attachments uploaded to a proposal, and the submission package built from them
• the documents sent with a pay-per-call price that is never paid, once the price expires an hour after the request
• the staged copy of a document sent by fax, within 24 hours of delivery or failure; a fax refused before it is sent keeps no copy
• Outputs of a free utility are deleted sixty to seventy minutes after they are created, for every caller.

Kept:

• the blank form's layout, shared across accounts (field names, positions and types, the text printed beside each box and the form's title; nothing about the person)
• the execution receipt's record: what happened and when, file sizes and fingerprints, no values
• a record of each file, without the file: what kind of file it was, its size, page count and fingerprint, when it was created, and which process produced or used it; no file names, no field values, no document content
• payment records and usage records
• a one-way fingerprint of each request to the pay-per-call API, whether it only asks for a price or also pays, so the payer can get the result back: for about an hour when no payment follows, and for 24 hours once paid; it cannot be turned back into the document
• a record of each fax: the masked destination number, pages, price and status; the full number and the internet address the request came from are kept for 90 days for abuse limits, refunds and disputes, then masked
• security logs
• a record that a form was deleted: when a form was deleted, and whether on the website, through the API or through a connector, with the API key used if any; no document content

The pay-per-call API is always ephemeral; account holders switch it on per request or for the whole account. See the pay-per-call guide for how the pay-per-call API works.

Reporting a vulnerability

Email contact@getemboss.ai and we will reply within five business days. See our security.txt for the machine-readable version of this contact.