How we protect your documents — and exactly what we can and can't see.
Documents are kept in the app's private storage on your phone and are not uploaded to our servers. They are protected by your phone's own security, such as its screen lock and device encryption. The only thing that leaves the phone is an image you choose to scan with AI, which is processed and deleted straight away.
A copy is kept on your phone and synced to our servers so you can use it on other devices and on the web. The app asks before it uploads anything for the first time. The details below apply to synced documents.
Backups you export from the app are encrypted on your phone with AES-256-GCM, using a key derived from your password (PBKDF2-HMAC-SHA256). We never receive the file or the password, so we cannot open it or recover a forgotten password.
No advertisers, no data brokers, no marketing lists. Period.
Your documents stay yours. We use Anthropic's Claude API, which per their policy does not train on commercial API customers' data by default.
Request deletion and we'll remove your documents and personal information within 30 days. We may verify the request comes from the account owner before processing.
AES-256 at rest on AWS S3. TLS 1.2 or higher in transit. These are widely deployed industry standards, including in financial services.
Production systems are accessed only via SSH key authentication by named team members — for support, abuse investigation, or legal compliance. We are honest below about what this means in practice.
Most document services aren't honest about this. We will be.
For documents you sync, NovexDocs is not a zero-knowledge service. This means:
All files stored in AWS S3 with AES-256 server-side encryption (SSE-S3). The application database runs on encrypted storage.
All connections use TLS 1.2 or higher. HSTS is enabled. We do not serve mixed content.
Hosted on Amazon Web Services in the ap-southeast-1 (Singapore) region. Files are stored in AWS S3, which is designed for 99.999999999% (11 nines) annual durability within the region. We do not currently run multi-region failover, which means an AWS region-wide outage would cause service downtime until AWS restores the region. Daily backups are retained off-instance.
Passwords are stored as bcrypt hashes (cost factor 10). Session tokens are JWT-based. Google OAuth 2.0 is supported for sign-in. Auth endpoints are rate-limited to slow brute-force attempts.
Our data handling is aligned with GDPR principles: right to access, right to delete, right to data portability. We are not SOC 2, ISO 27001, or HIPAA certified. See our Privacy Policy for the full picture.
If we identify a data breach that is likely to affect you, we will notify you without undue delay — within 72 hours where feasible — and inform the relevant supervisory authority as required by GDPR Article 33.
We take security seriously. If you discover a vulnerability, please report it responsibly and give us a reasonable window to fix it before public disclosure. We will not pursue legal action against good-faith security researchers who follow responsible disclosure.
Email security@novexdocs.comThis page is updated as our security practices evolve. Last updated: June 2026.