What actually happens to a document you upload, and what ProofMart’s verdict does and doesn’t mean. This page describes the real, current architecture — not aspirational plans.
Sign-in is handled by Supabase Auth: email/password, and Google OAuth where configured. Passwords are never stored by ProofMart directly — Supabase hashes and stores credentials on its own infrastructure. Sessions are cookie-based; every server request that touches your data re-verifies that cookie’s session before running any query.
Uploaded PDFs are written to a private Vercel Blob store — not a public one. The browser uploads directly to that store using a short-lived, single-use, size- and content-type-restricted token; the file is never routed through a third party in between. A private blob’s URL alone is not enough to read it — retrieving it requires the server’s own storage credential, which never reaches the browser.
If you upload while signed out, the file is processed and then deleted immediately — nothing about that upload is retained. If you upload while signed in, the result is saved to your account (My documents) and the original file is kept so you can reopen or re-run it — until you delete it.
PDF parsing, positioned-text extraction, and OCR (Tesseract.js, bundled and run in-process) all happen server-side, inside ProofMart’s own runtime. No document content is sent to a third-party AI or OCR API. Verification runs a fixed set of deterministic markers — arithmetic reconciliation, date-sequence checks, duplicate-transaction detection, encoding/extraction-confidence signals — never a machine-learning model making a judgment call. The same check on the same bytes always produces the same result.
/v1/verify, /v1/inspect, and /v1/extract require a Bearer API key and are rate-limited per key. Webhook deliveries are signed with HMAC-SHA256 (x-proofmart-signature) so a receiver can confirm a delivery genuinely came from ProofMart; a registered webhook URL is checked against private/internal address ranges both when you add it and again immediately before every delivery attempt.
All traffic to ProofMart is served over HTTPS. Data at rest (documents, results, account data) sits in Supabase’s managed Postgres and Vercel Blob, both encrypted at rest by those providers. Downloadable dossiers are signed with Ed25519 (Node’s own crypto module) so a modified dossier fails verification.
Deleting a document removes both its database record and its stored file — not one without the other. Anonymous uploads are never retained in the first place. Internal operational records (rate-limit counters, webhook delivery logs) exist only to make the product work and aren’t document content.
No other third party ever receives document content.
A CLEAR verdict means every check that could run found no inconsistency — it is not a legal, forensic, or accounting certification, and it does not confirm a document’s issuer, absolute correctness, or authenticity in a broader sense. ProofMart is not SOC 2, ISO 27001, HIPAA, or PCI certified, and does not hold GDPR certification (GDPR itself has no formal certification scheme to hold). Treat a ProofMart result as one input to a review, not a substitute for verifying a document with the party that issued it.
ProofMart is early-stage and doesn’t yet have a dedicated security contact address or bug-bounty program — that’s a real gap, stated honestly rather than papered over with an inbox that isn’t actually monitored.