Trust & security
Built for institutional review.
Forward this page to your IT, security, or legal team. The information below is what a procurement office typically asks us in the first round of review.
Last updated April 22, 2026
Data handling
Documents are not stored server-side by default. Text extraction from PDFs and DOCX files happens in your browser (via pdfjs, Tesseract for OCR, and mammoth). Only the extracted text and image thumbnails are sent to our AI provider for the remediation pass, and the remediated output is rendered to DOCX / tagged PDF / HTML client-side before download.
We store preflight metadata (file name, file type, accessibility score, structured findings list) and processing metadata (model used, duration, success/failure, error messages) in our database so your admin dashboard can show tenant-wide activity and produce compliance reports. We do not store the document contents themselves.
Authentication is handled by Supabase (Postgres + Auth). Row-level security isolates every tenant's data at the database layer — it's not an application-level convention. A query that bypasses our code still can't cross tenant boundaries.
Data residency:Primary database is hosted in us-east-1. Application is deployed on Vercel's global edge network. Institutional customers with EU data-residency requirements should contact us for a dedicated deployment.
Retention:Preflight and processing metadata are retained for the life of the tenant's account. On account termination, all tenant data is deleted within 30 days. Customers can request export or expedited deletion at any time.
Security
All traffic is HTTPS-only with TLS 1.2 or higher, terminated at Vercel's edge. Database connections use TLS. Passwords are hashed by Supabase Auth (bcrypt). Session cookies are HttpOnly + SameSite + Secure.
API routes enforce authentication and tenant-admin authorization checks. Rate limiting on document-processing endpoints is tier-aware (sliding-window via Upstash) to prevent abuse.
Errors are captured in Sentry with sendDefaultPii: false — request bodies and user email addresses do not leave our infrastructure. Structured logs are shipped to Vercel and retained per Vercel's policy.
Vulnerability disclosure: Email bwinchell@esdesigns.org with “Security” in the subject line. We will respond within 2 business days.
AI provider
Remediation uses Anthropic's Claude models (Haiku 4.5 for short documents, Sonnet 4.6 for long documents). Anthropic does not train its models on content sent via the API. Their zero-retention policy applies to all Document Ally Pro traffic.
The remediation pass sees: document text (extracted in your browser), image thumbnails where alt-text generation is needed, and the system prompt that defines accessibility remediation rules. It does not see: your account email, your tenant identity, other documents from your tenant, or any preflight/processing history.
If your institution requires a Business Associate Agreement (BAA) or a data-processing addendum with Anthropic, contact us — we can facilitate the relationship for Institutional plan customers.
Compliance posture
ADA Title II (2024 final rule + 2026 IFR)
Document Ally Pro is designed to help covered entities meet the final-rule requirement that web content, including course materials, conform to WCAG 2.1 AA. The April 2026 Interim Final Rule extended compliance dates by one year: April 26, 2027 for entities with a total population of 50,000 or more, and April 26, 2028 for entities under 50,000 and any special district government. Our remediated outputs target WCAG 2.2 AA so you are a version ahead of the rule floor.
WCAG 2.2 AA
Our tagged PDF output includes heading structure, reading order, alt text on images, descriptive link text, and semantic lists. The DOCX output opens in Microsoft Word's Accessibility Checker with zero errors on standard templates.
Section 508
Our outputs align with Section 508 Revised Standards, which reference WCAG 2.0 AA as the federal minimum.
FERPA
Because documents are not stored server-side, student work processed through Document Ally Pro does not create a new education-record repository requiring FERPA disclosure. Preflight and processing metadata contain no student-identifying content beyond the uploader's account email.
HIPAA
We are not HIPAA-covered. Do not upload documents containing protected health information (PHI).
SOC 2 / ISO 27001
We do not currently hold SOC 2 Type II or ISO 27001 certification. We inherit the security practices of Supabase (SOC 2 Type II, HIPAA BAA-eligible) and Vercel (SOC 2 Type II, ISO 27001, PCI DSS) as our underlying infrastructure providers. Institutional customers can request their attestation reports.
Accessibility of the product itself
An accessibility remediation tool that isn't itself accessible would be disqualifying. Our public pages, login flow, upload/batch workflows, and admin dashboards target WCAG 2.2 AA.
If you find an accessibility barrier in the Document Ally Pro product itself, please email bwinchell@esdesigns.org with “A11y” in the subject line. We treat product accessibility as a security-class bug.
Contact
Security questions, vulnerability reports, compliance review:
bwinchell@esdesigns.org
Institutional procurement and demos:
bwinchell@esdesigns.org
Accessibility barriers in the product:
bwinchell@esdesigns.org