Where your matter goes, what happens to it, and what never happens. Operational facts, not assurances.
Files are held in memory from upload to the end of the run. As each file is read, its bytes are released and only the rows, the identity block and the checks survive. The built matter stays in memory for 24 hours after you last open it — never longer than 72 hours after it finished — so you can download the exhibit and the schedules, or until you discard it, whichever is first; the page shows the time and lets you extend it. Nothing is written to disk. There is no document archive, no extract warehouse and no "deleted after 30 days": there is nothing to delete.
The register records the SHA-256 of every file as received, its size and page count, whether text was read or OCR'd, and the method version. The footer of every exhibit page repeats the findings hash. Because no copy stays with us, the register and the hash are the custody record, and they travel inside the exhibit.
Parsing, OCR and the exhibit run on our own server. Image-only pages are read by tesseract on that server, in memory. No cloud OCR, no document API, no language model.
The input hash of a paid matter, so the rerun is free; your email address and plan if you create an account, and the billing identity Dodo Payments holds if you paid; categorical usage counts (file counts, page counts, outcomes, timings). Never a file, a row, a name, an amount or an account number. A rerun means dropping the same files again.
TLS on every connection. The application runs as an unprivileged user on a file system that is read-only except for its own account database and usage log, on a server in the United States that we administer. Payments are handled by Dodo Payments as merchant of record; sign-in links are sent by our email provider. Neither ever sees a statement.
Every check is arithmetic or a rule written on the method page. Nothing in the path from the files to the exhibit can vary, so the exhibit is a deterministic function of the files, the method version, the examiner's edits and the screen parameters. The findings hash on every page lets the other side rerun the same files and compare; the procedure is written down. That is a separate fact from custody: no third party ever receives the files, whatever the method does.
Rule 1.6(c) asks counsel to make reasonable efforts to prevent unauthorized disclosure of, or access to, information relating to a representation. Here the statements are read in memory on one server we administer, no third party receives them (no cloud OCR, no document API, no model vendor), nothing relating to the matter is retained once it is discarded, a day after it was last opened, and there is no store for anyone to access or subpoena. The duty stays with counsel; these are the facts a reasonable-efforts inquiry finds.
Redact inside the PDF (draw boxes in the file as downloaded) rather than printing and rescanning, which erases the provenance the structure checks read. Password-protected files are opened with the password you supply for the duration of the run only.
Questions about a firm's security review: ville@docuritas.com. We answer in writing. The privacy policy states the same facts as policy.