Security and data handling
Written for the person who has to approve a vendor. What we do, where your documents go, and — at the bottom — what we have not built.
Every control described here is implemented today. Where something is planned rather than shipped, it appears under “What we have not built yet” rather than being left out.
Your documents
The part that matters most: where a file goes, who processes it, and when it stops existing.
- Where documents are processed
- On our own servers in Frankfurt, Germany. Recognition runs on a dedicated machine we control, not on a third-party OCR service. Account data, usage records and backups live in Google Cloud’s europe-west3 region, also Frankfurt.
- How documents travel
- Every connection is HTTPS. The API certificate is issued by Let’s Encrypt and renews automatically; renewal is tested rather than assumed. Uploads reach the recognition server through our own application layer, never directly from the browser.
- How long documents are kept
- Original files are deleted within one hour of processing, for free-tool visitors and account holders alike — each file is removed the moment its job finishes, and a scheduled sweep clears anything a failure leaves behind. Extracted results are kept for up to 30 days so you can retrieve them, then deleted automatically. Deletion removes the stored data, not merely the link to it.
- AI extraction
- Documents sent for structured extraction are processed by Google’s Gemini API on a paid tier, which excludes them from model training by contract. Nothing is retained by us beyond your plan’s retention window, and no document or extracted field is ever used to train or improve any model.
Accounts and access
How we protect the credentials that reach your documents.
- Passwords
- Handled by Firebase Authentication and never seen by our own code. Passwords must be at least 8 characters with an uppercase letter, a lowercase letter and a number, enforced by the identity provider rather than by the form alone.
- Bot protection
- Sign-up and sign-in are protected by reCAPTCHA Enterprise in enforcing mode — requests that cannot present a valid token are rejected. Password reset carries its own separate score-based assessment.
- Account enumeration
- Sign-in and reset responses are deliberately identical whether or not an address has an account, so the product cannot be used to discover who your colleagues are.
- API keys
- We store only a SHA-256 hash of each key, under that hash. The key itself is shown once at creation and cannot be recovered by us — support cannot read your key back to you, because there is nothing to read. Revoking a key stops it working within 60 seconds.
- Suspended accounts
- Blocking an account ends its sessions, refuses its sign-in, and disables its API keys. A blocked account cannot convert, extract, or mint new credentials.
- Administrative access
- Administrative rights come from a server-verified claim on the account, not from anything the browser can assert. Every account that can reach production infrastructure — hosting, database, DNS, payments, email — carries two-factor authentication.
Infrastructure
The machine, the database and the money.
- Server access
- SSH accepts public keys only; password authentication is disabled outright and direct root login is refused. The firewall rate-limits SSH, and repeated failures are banned automatically.
- Backups
- Nightly, encrypted with AES-256 before they leave the machine, and stored off the server. Thirty days are retained. The restore path has been executed end to end — downloaded, decrypted and inspected — not merely configured.
- Database rules
- Firestore and Storage default to deny. Application access goes through server-side code holding verified credentials; the browser cannot read another account’s records.
- Payments
- Card details never reach VisionParse servers. Checkout is handled entirely by PayPal, and we store only the resulting subscription or order reference.
What we have not built yet
The gaps, stated plainly. If one of these is a blocker for you, tell us — it is useful to know which ones people actually need.
- No formal certification
- We do not hold SOC 2, ISO 27001 or an equivalent audit. We are a small company and we would rather say so than imply otherwise. The controls on this page are real; an independent auditor has not examined them.
- No published uptime history
- We monitor availability but do not yet publish a historical uptime record, so we make no availability promise outside the Business plan target stated on the pricing page.
- Single-region processing
- Everything runs in Frankfurt. We do not currently offer processing in another region, data residency guarantees beyond the EU, or a self-hosted deployment.
- No SSO
- Single sign-on and SAML are on the roadmap and are not built. Sign-in today is email and password, or Google.
Reporting a vulnerability
Email VisionParse@senithu.lk with enough detail to reproduce the issue. We will acknowledge within two business days and tell you what we intend to do. We will not pursue anyone who reports a genuine finding in good faith and does not access or destroy other people’s data while doing it. We do not run a paid bounty programme.
Procurement documents, a signed DPA or a security questionnaire? Ask us directly
See also the data processing agreement, the sub-processors we use, and the privacy policy.