Security

Files in transit and at rest

• All connections terminate at Cloudflare with TLS 1.3.
• Files are stored in private Cloudflare R2 buckets, encrypted at rest.
• Auto-deletion runs within 24 hours of conversion — both input and output.
• Conversion workers run in isolated processes; one job cannot read another job's files.

Authentication

• Passwords hashed with PBKDF2-SHA256, never stored in plaintext.
• Session tokens are short-lived JWTs signed with HS256.
• Admin panel uses a separate signing secret and HttpOnly session cookies.
• Login endpoints are rate-limited per IP and per email to slow brute-force.

API keys

• API keys are hashed before storage (we never display them again after creation).
• Each request is rate-limited per key.
• You can revoke any key from your dashboard at any time.

Infrastructure

• Edge: Cloudflare Workers (DDoS-protected, geographically distributed).
• Database: managed Postgres on Neon with daily backups.
• Conversion workers: dedicated Fly.io machines, no public ingress.
• Secrets are stored as Cloudflare and Fly secrets — never in source.

Reporting a vulnerability

Found something? Email security@docforge.cc. We acknowledge within 48 hours and aim to triage within five business days. We don't pursue legal action against good-faith research that follows responsible disclosure.