Security at AutomaDocs
Your code is your most valuable asset. We built AutomaDocs with security as a foundation, not an afterthought.
Infrastructure Security
Enterprise-grade infrastructure with multiple layers of protection.
- ✓All data encrypted at rest (AES-256) and in transit (TLS 1.3)
- ✓Hosted on Railway and Vercel with SOC 2 compliant infrastructure
- ✓Regular security audits and automated vulnerability scanning
- ✓DDoS protection and Web Application Firewall (WAF)
Complete Data Isolation
Your code never touches shared processing environments.
- ✓Complete tenant isolation — each repository processed independently
- ✓No shared runtimes or cross-tenant data access possible
- ✓Vector embeddings stored with strict namespace separation
- ✓Database-level row security for all user data
Authentication & Access
Industry-standard authentication with minimal permissions.
- ✓GitHub and Google OAuth with secure token handling
- ✓JWT tokens with short expiration (7 days, auto-refresh)
- ✓HTTP-only cookies prevent XSS token theft
- ✓CSRF protection on all state-changing operations
- ✓Enterprise SSO (SAML, OIDC) available for Team and Enterprise plans
Code Security
Your code is accessed only with your explicit permission.
- ✓Repository access requires explicit user authorization
- ✓GitHub tokens stored encrypted, never logged or exposed
- ✓Webhook signatures validated on every request (SHA-256 HMAC)
- ✓Rate limiting prevents abuse and brute force attacks
- ✓Code is processed in memory and not persisted beyond documentation
Compliance & Privacy
Meeting enterprise compliance requirements.
- ◐SOC 2 Type II certification in progress
- ✓GDPR compliant data handling and processing
- ✓Data deletion available on request within 30 days
- ✓No data sold to third parties, ever
- ✓Self-hosting option for Enterprise customers with strict requirements
Responsible Disclosure
We take security reports seriously and respond quickly.
If you discover a security vulnerability in AutomaDocs, please report it responsibly. We commit to:
- • Acknowledging your report within 24 hours
- • Providing regular updates on our progress
- • Crediting you in our security acknowledgments (if desired)
- • Not pursuing legal action for good-faith security research
Contact: security@automadocs.ai
Please include detailed steps to reproduce the vulnerability and any relevant proof-of-concept code.