Security & privacy
Privacy built into the architecture.
Your documents are some of the most sensitive things you own. We take that seriously: Stoatify is built privacy-first at the architecture level, so your files stay yours, whether you are one person or a whole company.
- Encrypted in transit
- Private by architecture
- No ads, ever
- No training on your data
How we protect your documents
Six principles enforced in code.
These are properties of how the system is built, not promises in a policy.
Proxied, never exposed
The browser never talks to object storage. Every byte flows through the API behind your authenticated session, with server-side credentials. Buckets stay fully private, with no public or pre-signed URLs to leak.
Visible only to the right people
Your identity is verified on every single request. A document you are not allowed to see returns a 404, not a 403, so your vault never reveals even that something exists.
Encrypted in transit and at rest
Everything moves over TLS. Files rest in encrypted object storage, and sensitive secrets are sealed with authenticated encryption before they are ever stored.
Private by default
No ads. We never sell your data and never train AI on your documents. Privacy is the default state of the product, not a switch you have to find and turn on.
Text extraction you can trust
The OCR that powers search runs inside Stoatify, so the contents of your scans are never sent to a third-party service to be read. Your documents stay in your vault.
You hold the keys to your data
Export or permanently delete everything whenever you want. Deleted items are purged on a fixed schedule, and a revoked share or trashed file stops resolving immediately.
The central design choice
Your files never touch the open internet.
Most apps hand your browser a direct link to a storage bucket. Stoatify does not. Every upload, preview and download is proxied through the API behind your authenticated session, with storage credentials that only the server holds.
- No public or pre-signed storage URLs to guess, share or leak
- Storage keys are never sent to the browser
- Previews and downloads use short-lived, single-document tokens
- A trashed file or revoked link stops resolving immediately
Built for everyone
Whether it is just you, or your whole team.
The same secure foundation, with the controls each of you needs.
For you
Your passports, taxes, medical records and receipts belong to you and no one else. Stoatify keeps them that way.
- Your personal vault is private to you by default
- Two-factor authentication and passkeys, including FIDO2 physical security keys
- OCR runs inside Stoatify, never sent to a third-party service to be read
- No ads, no data selling, no training on your documents
- Password-protected, expiring share links for a single file or a whole saved search, revocable any time
- Encrypted in transit, stored behind your login
- Export or delete everything, on your schedule
For your team
Bring teammates into one organization with clear built-in roles, secure sharing, version history, and an activity record.
- Strict per-organization isolation: another tenant's data 404s, no existence leak
- Two-factor authentication and passkeys, including FIDO2 physical security keys
- Built-in Owner, Admin and Member roles
- Invitations and groups for organizing teammates
- Password-protected, expiring share links
- An org-wide activity feed and field-level version history
- E-signatures sealed with a tamper-evident audit certificate
Team security
A clear, accountable home for team documents.
Invite teammates into an organization, assign an Owner, Admin, or Member role, and organize people into groups. Activity and version history keep important changes visible.
- Built-in roles for owners, administrators and members
- Groups and email invitations for organizing the team
- Password-protected, expiring share links with revocation
- Immutable version history: every re-upload is kept, and any prior version restores in a click
- A complete field-level audit trail and an org-wide activity feed of who changed what, and when
- Configurable Trash retention you control, so nothing lingers longer than you want
Private by default
Your documents stay yours.
The text extraction that powers search runs inside Stoatify, so the contents of your scans are never sent to an outside service to be read. No ads, no data selling, and nothing trained on your documents.
- Built-in OCR: document contents are never sent to a third-party service
- We never train AI models on your documents
- No ads and no selling of your personal information, ever
- Export or delete everything on your schedule
Under the hood
The engineering behind the promise.
Strong, verified sign-in
Protect your account with two-factor authentication or a passkey, including a FIDO2 physical security key, through the standard account-management dialog. Sign-in tokens are verified on every request.
Short-lived capabilities
Previews and downloads use signed, time-boxed tokens scoped to a single document. They are re-checked live against the database, so they die the instant a file is trashed or a link is revoked.
Abuse resistant
Upload size is capped at the edge, and uploads, link resolves and content streams are rate limited. Share-link passwords are bcrypt-hashed and compared in constant time.
Reviewed by design
The access boundary is built around adversarial review. Every document query is scoped server-side, and storage keys are never exposed to clients.
You own your data
You can always take it back.
Lock-in is not a security strategy. Your documents are yours to leave with, or to erase, at any moment.
Export anytime
Download your originals whenever you want. Nothing is held hostage.
Permanent deletion
Permanently remove documents; deleted items are purged from storage on a fixed schedule.
No surprises
No ads, no selling your data, no training AI on your documents. Ever.
Review the evidence in our Trust Center.
Read our security documentation, subprocessor list, and operating policies, and request our security questionnaires.
Found something? We welcome responsible disclosure at security@stoatify.com. Read our Vulnerability Disclosure Policy before testing.
Keep your documents in one secure place.
Encrypted, private, and yours alone. Start free in under a minute.
No credit card required