Security
DocSpring follows industry best-practices to keep your data safe:
- You can only access the DocSpring service via TLS (https). We enforce this with HSTS headers.
- Our databases are encrypted at rest, and submission data is encrypted again with AES-256 before it's stored.
- Our Redis job queue and cache are encrypted at rest and in transit.
- All stored customer files are encrypted at rest, using the AWS Key Management Service. This includes templates, generated documents, and any other customer files that are stored in Amazon S3. Logs and signing integrity records are encrypted with S3-managed keys.
- Passwords are hashed with bcrypt at a cost factor of 11. We do not store plaintext passwords in our database.
- You can turn on two-factor authentication for your login.
- Our PDF and image tools and our document converters run in isolated AWS Lambda functions, away from our database and encryption keys.
- Staff commands on production go through a single sign-on gateway that needs a hardware security key, and every one is logged.
- Your documents are stored in the region you choose when you sign up: the US or the EU.
- We record application, access, and administrative activity to support security monitoring and investigations.
- Retention depends on the type of log. API and webhook database logs are subject to a 90-day deletion schedule. Lambda worker logs are retained for 30 days, and container performance metrics for 60 days. Application, system and API proxy logs are retained for 1,096 days (three years), as are records of access to stored documents, including IP addresses. EU records are stored in the EU. Security log entries, which record actions on an account and staff access to it, with IDs and IP addresses, are retained for 3 years, including after the account is deleted. They stay in the region where they were recorded. The administrative gateway's audit logs are retained for 2,557 days (approximately seven years). Other infrastructure logs, such as network flow logs, are retained for up to 1,096 days. Database recovery copies have separate retention periods, described in our privacy policy.
- We subscribe to security mailing lists and patch any vulnerabilities as soon as possible.
Compliance
-
SOC 2 Type II
-
GDPR Compliant
-
HIPAA Compliant
DocSpring has completed a SOC 2 Type II audit and is GDPR and HIPAA compliant.
Our SOC 2 Type II report and security whitepaper are available on request from the DocSpring Trust Portal. Please contact security@docspring.com for any additional information.
The SOC 2 Type II report covers July 24 to October 22, 2025, for Security, Confidentiality, and Availability.
HIPAA Compliance
DocSpring is HIPAA compliant. We sign a Business Associate Agreement (BAA) with customers on every paid plan, including Starter. The free Developer plan doesn't include one. To request a BAA, please contact support@docspring.com.
You must sign a BAA with us before submitting any protected health information (PHI) to DocSpring.
PCI DSS
DocSpring is not PCI DSS certified. You must not submit any credit card information to DocSpring.
Vulnerability Disclosures
DocSpring welcomes vulnerability disclosures.
Please send an email to security@docspring.com
to report any security vulnerabilities.
You can find our PGP public key at:
https://docspring.com/pgp-key.txt
Questions?
Any questions about security can be sent to security@docspring.com