How DocuRequest protects client documents

Client links contain a long, unguessable value: either a random token, of which DocuRequest stores only a one-way hash, or a link ID signed with a secret key kept on the server.

A link opens a single case and expires after at most 30 days. Your team can revoke a link at any time.

Client portal pages tell browsers not to pass the link on to other websites.

Your team's access to clients, cases, files and links is checked against the signed-in user's workspace. For support, DocuRequest platform operators can see details such as workspace, user, client, case and file names, with email addresses partly masked. The operator portal has no way to open or download files. As with any hosted service, the people who run DocuRequest administer the infrastructure where files are stored.

Role-based access: admins manage users, billing, presets, email templates and the audit log; staff work on clients, cases and client links; internal viewers can sign in but don't see client, case or file data.

Disabling a user or suspending a workspace ends their active sessions immediately. A suspended workspace's client links stop working until it is reactivated.

Uploaded files are never served from public URLs. Every download is checked against a signed-in member of the workspace or a valid client link for that case.

Files are downloaded as attachments instead of being opened as web pages.

Uploads are limited in size and in number per requested document, and files with common executable or script extensions, such as .exe, .msi, .bat, .sh, .ps1 and .js, are rejected.

Passwords are stored as bcrypt hashes, never in plain text.

Sessions are stored on the server and identified by an HTTP-only cookie that page scripts can't read.

Repeated sign-in attempts for the same email address are rate-limited.

Sign-in, account and client portal pages can't be embedded in other websites.

DocuRequest is served over HTTPS.

Key staff and admin changes, such as status changes, approvals, staff uploads and deletions, client link changes and user changes, are recorded in an audit log where workspace admins can see who made each change, what kind of change it was and when. Uploads and comments that clients add through a link are shown on the case with a timestamp but are not recorded in the audit log. File downloads and case exports are not currently logged.

Each case keeps its status history, and uploaded files and comments are shown under their requested document with a timestamp. While a document is not yet approved and its case is open or in progress, admins can delete any file or comment and staff can delete their own. Staff and admins can also remove a requested document that has no files yet, together with its comments. These deletions are recorded in the audit log.

Subscriptions are paid through Stripe Checkout and the Stripe customer portal. Card details are entered on Stripe-hosted pages and never reach DocuRequest's servers.

Billing updates from Stripe are accepted only with a valid Stripe webhook signature.