> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neudocs.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> How NeuDocs protects tenant data, uploads, access, secrets, and sensitive operations.

NeuDocs is designed for sensitive tax, accounting, financial, and legal documents.

## Access controls

* Staff authenticate through Supabase Auth and must complete multi-factor authentication.
* Firm roles limit administrative actions.
* Server-side authorization is performed again for mutations and data access.
* Client portal sessions are scoped to one request.
* Tenant tables use forced PostgreSQL row-level security.

## File protection

Uploads are stored in private object storage. Access uses short-lived signed operations rather than public file URLs. Every upload enters the scan pipeline; infected files are quarantined and unavailable for normal review.

## Secrets

API keys, client-link secrets, webhook signing secrets, and document-AI provider keys are not logged. Provider keys are encrypted at rest when the server encryption key is configured. NeuDocs stores hashes—not recoverable plaintext—for NeuDocs REST API keys.

## Data minimization

Audit and notification metadata avoid raw sensitive document text. Email and push messages describe required action without attaching documents or exposing confidential content.

## Your responsibilities

* Invite only authorized staff and remove access promptly.
* Protect recovery codes and API keys.
* Configure retention to match contracts and law.
* Obtain any consent or lawful basis required for identity capture and AI processing.
* Export completed records only to approved systems.
* Report suspected vulnerabilities through the [vulnerability disclosure policy](https://neudocs.app/legal/vulnerability-disclosure).

For legal terms and current disclosures, use the canonical [Trust Center](https://neudocs.app/legal/trust), [Privacy Policy](https://neudocs.app/privacy), and [Data Processing Addendum](https://neudocs.app/legal/dpa).


## Related topics

- [Quickstart](/quickstart.md)
- [index](/index.md)
- [Support and responsible disclosure](/reference/support.md)
- [Notifications](/workspace/notifications.md)
- [Core concepts](/concepts.md)