What happens to your documents.
Where files are stored, who can see them, how long anything is kept, how it is deleted and how results are signed, as the system is built today, including the parts that aren’t done yet.
At a glance
| Topic | Answer | Detail | Section |
|---|---|---|---|
| Storage | Private blob store | No public URLs. Reading a file needs a credential only the server holds. | Details |
| Access | Only the uploader | Postgres Row Level Security enforces it on every table, in the database itself. | Details |
| Retention | Signed-out: deleted | Processed, then deleted as soon as the scan finishes. Nothing about the upload is kept. | Details |
| Retention | API: never stored | /v1/verify processes the file in memory. Only the response leaves. | Details |
| Deletion | Saved: until you delete | Deleting removes the record and the stored file together, never one without the other. | Details |
| Processing | No third-party AI | Parsing and OCR run inside ProofMart. No document content goes to an outside AI or OCR API. | Details |
| Signing | Ed25519 and HMAC | Dossiers are signed with Ed25519; webhook deliveries with HMAC-SHA256. | Details |
| Certifications | None yet | ProofMart is not SOC 2, ISO 27001, HIPAA or PCI certified. | Details |
A document’s path, by how it arrived
- Signed outUpload → scan → deletedNothing kept
- API keyPOST → in memory → responseFile never stored
- Signed in, savedUpload → private blob → yoursUntil you delete it
01Storage
Uploaded PDFs are written to a private Vercel Blob store, not a public one. The browser uploads directly to that store with a short-lived, single-use token restricted by size and content type, so the file is never routed through anyone else on the way.
A private blob’s URL is not enough to read it. Retrieving a file needs the server’s own storage credential, which never reaches the browser.
02Access control
- Every table (documents, API keys, webhooks, usage, audit events) enforces Postgres Row Level Security. A query only ever returns rows owned by the requesting user, enforced in the database, not just in application code.
- Every server request that touches your data re-verifies your session before it runs a query.
- The Supabase service-role key, which bypasses Row Level Security, is used for a small set of server-side operations only (validating an API key, recording usage, delivering a webhook) and is never sent to the browser.
03Processing
PDF parsing, positioned-text extraction and OCR (Tesseract, bundled and run in-process) all happen server-side inside ProofMart’s own runtime. No document content is sent to a third-party AI or OCR API.
Verification is a fixed set of deterministic rules (arithmetic reconciliation, date order, duplicate detection, encoding and OCR confidence), not a machine-learning model making a judgment call. The same bytes always produce the same result.
04Retention
What is kept depends on how a document arrived.
| Data | Kept for | Removed by |
|---|---|---|
| File uploaded while signed out | Not kept | Deleted as soon as the scan finishes |
| File sent to the API | Not stored | Processed in memory; only the response leaves |
| Saved document: original file and result | Until you delete it | You, from My documents; record and file go together |
| Webhook delivery log, including the result payload | 90 days | Pruned automatically, daily |
| Audit events (sign-ins, uploads, key and webhook changes) | 180 days | Pruned automatically, daily |
| Rate-limit counters | 1 day | Pruned automatically, daily |
| API keys, stored as a SHA-256 hash, never the raw key | Until revoked | You; revoking takes effect immediately |
If you register a webhook, each delivery’s payload is the verification result, which includes extracted text and finding summaries. That log exists so failed deliveries can be retried and debugged, and it is pruned after 90 days.
05Deletion
- Signed-out uploads delete themselves: the stored file is removed as soon as the scan finishes.
- A saved document stays until you delete it. Deleting removes its database record and its stored file together, never one without the other.
- Revoking an API key takes effect immediately; the stored hash can no longer authenticate a request.
06Signing & encryption
- Downloadable dossiers are signed with Ed25519 using Node’s own
cryptomodule. A modified dossier fails verification, and anyone can check one at/v1/verify-signaturewithout an account. - Webhook deliveries are signed with HMAC-SHA256 in the
x-proofmart-signatureheader, so a receiver can confirm a delivery came from ProofMart. - All traffic is served over HTTPS.
- Data at rest (documents, results, account data) sits in Supabase’s managed Postgres and Vercel Blob, both encrypted at rest by those providers.
07API & webhooks
/v1/verify,/v1/extractand/v1/inspectrequire a Bearer API key and are rate-limited per key.- API keys are shown once, at creation. Only a SHA-256 hash is stored; ProofMart cannot recover a raw key.
- A webhook URL is checked against private and internal address ranges when you add it, and again immediately before every delivery attempt.
08Authentication
Sign-in is handled by Supabase Auth: email and password, and Google OAuth where configured. ProofMart never stores passwords itself; Supabase hashes and stores credentials on its own infrastructure. Sessions are cookie-based.
09Providers
Two infrastructure providers handle data, and a payment processor handles Pro checkout. No other third party receives document content.
| Provider | Used for | Holds |
|---|---|---|
| Vercel | Hosting, serverless compute, private Blob storage | Uploaded files, while they are kept |
| Supabase | Postgres database, authentication | Account data and saved scan results |
| Razorpay | Payments for the Pro plan, once billing is enabled | Your email, user ID and the order; card, UPI or bank details you enter at checkout stay with Razorpay |
10What a verdict does not mean
A CLEAR verdict means every check that could run found no inconsistency. It is not a legal, forensic or accounting certification, and it does not confirm who issued a document or that it is authentic in a broader sense. Treat a ProofMart result as one input to a review, not a substitute for checking with the issuer.
ProofMart is not SOC 2, ISO 27001, HIPAA or PCI certified, and does not claim GDPR certification; GDPR has no formal certification scheme to hold.
11Reporting an issue
To report a security issue, write to deepanshulathar@gmail.com — the address is also published at /.well-known/security.txt. Include what you found, how to reproduce it, and how to reach you. There is no bug-bounty program; urgent reports go first.