The real controls protecting your documents.

AES-256 encryption at rest

Uploaded documents and generated files are stored in Cloudflare R2, which encrypts every object at rest with AES-256 using keys managed by Cloudflare. This encryption is automatic and cannot be turned off, and DocTalk never handles the storage encryption keys. The document viewer loads a file only through a signed link that expires after five minutes, issued after the backend has checked that you may access it; generated files such as translated PDFs are downloaded through the backend, also after an access check.

Cloudflare R2 data security · backend/app/api/documents.py · get_document_file_url()

TLS 1.2+ in transit

Public web access uses HTTPS. Internal service connections may use private platform networking. Processing services can read the content needed to provide the requested features; this is not end-to-end encryption that hides content from those services.

DocTalk does not train models on your data

Depending on the feature and configuration, relevant document content and questions may be processed by DeepSeek directly, through OpenRouter and its upstream providers, or by OCR and translation providers. DocTalk does not sell your data or use it to train models. Provider retention and training terms vary by service and configuration; no universal zero-retention guarantee is made.

Magic-byte file validation

Uploads are checked against file signatures and supported parsers. Renaming an executable does not make it a supported PDF. File validation is not a complete malware scan of embedded content.

backend/app/services/upload_service.py · magic-byte check

SSRF protection on URL ingestion

When you drop a URL to summarize, the backend validates the target against an allow-list of public hosts and rejects any request to private IP ranges, link-local addresses, or cloud metadata endpoints (169.254.169.254, etc).

backend/app/core/url_validator.py

Rate limits on anonymous endpoints

Public endpoints (shared views, anonymous reads) have per-IP rate limits. The real client IP is forwarded from the Vercel edge to our backend with an HMAC-SHA256 signature bound to a per-request timestamp, so the backend can authenticate the proxy origin and reject header-spoofing attempts. This is not a defense against an active wire-level MITM — TLS handles that layer. Authenticated users bypass IP rate limiting.

backend/app/core/rate_limit.py · shared_view_limiter, anon_read_limiter

Full data export

Profile → Account exports JSON with account details, document metadata, document conversations, saved quotes, and recent credit history. Original uploaded files and separate generated artifacts are not included in this account export.

Account deletion

You can delete your account from Profile → Account. All documents, sessions, chat history, embeddings, and billing records are removed; the account is not recoverable after deletion.

User isolation

Private document access is checked against account ownership. Public demos and share links have separate access rules. A share link exposes the answer or conversation and included source excerpts you choose to share.