Your documents stay yours

Who can see what

• You: your documents, forms, share links and every response.
• People you send a link to: only the blank form, and only while the link is open. They can't see other responses, your other forms or your account.
• Other DocuFillr users: nothing. Every document, form and response is tied to its owner's account, and the service checks this on every request.
• Automated processing: to detect fields, your documents are processed automatically on our server. On Premium, some features also use an AI model, which receives only the minimum needed. No person reviews this.
• Us: we don't routinely look at your documents or responses. Authorised staff can access account data only when needed: to help when you ask, to investigate a security problem or misuse, or when the law requires it. We can't read answers to end-to-end encrypted forms.

Share links

• Each link is a long random code that can't practically be guessed.
• Links always close, after 1 hour to 30 days, and stop after a set number of responses.
• You can turn a link off at any time, and it stops working immediately.
• People filling in a form don't need an account. We don't use analytics or advertising trackers. A bot check from our infrastructure provider runs on shared forms to stop automated spam.

Encryption

• In transit: every connection uses HTTPS.
• At rest: your files (documents, images and answer files) are stored encrypted by our infrastructure provider. This protects stored data; the service itself can still read it in order to run.
• End to end: optional for each form on Premium, below.

End-to-end encrypted forms (Premium)

• Turn it on for a form from its Share window.
• Your encryption key is created in your browser. We store it only in locked form: once with your encryption password, and once with a recovery key shown to you a single time. We never have the unlocked key.
• The filler's browser encrypts their answers before sending them. We store only the encrypted answers and never make a PDF from them.
• To read responses, you unlock them with your encryption password. The completed PDF is made in your browser.
• If you lose both your password and your recovery key, nobody can recover the answers, including us.
• Limits: the blank form, which form a response belongs to and when it arrived are not encrypted. Encryption runs in the browser, using code DocuFillr serves, so it can't protect a device or browser that's already compromised. Unsent drafts stay unencrypted on the filler's own device until they submit.

Signing in

• Sign in with Google, or with an email and password. We store passwords only as a salted hash, never the password itself.
• Your session lives in a secure, HTTP-only cookie that scripts on the page can't read.
• Sign-in attempts and other requests are rate-limited to slow down automated attacks.

Suspicious activity

• We watch for signs of misuse, such as repeated failed sign-ins, floods of requests and reports of abusive or phishing forms.
• To protect you, the people filling in your forms and the service, we may temporarily suspend or restrict an account while we look into it.
• A suspended account can't be used, whichever device or session it's signed in on, and its share links stop taking responses.
• Suspending an account doesn't delete anything. If it was a mistake, email us to ask for a review, and everything works again once it's reactivated.

Uploads and abuse

• Only PDF files within the size and page limits of your plan are accepted; anything else is refused. Unusually large pages and images are refused rather than processed.
• Requests, sign-ins and form submissions are rate-limited, and shared forms can be protected by a bot check.
• Errors and the service's health are monitored, so we notice problems quickly.

Who runs what

• A small number of trusted providers host the website, the server, file storage and the database, send our emails, run Premium's AI features, and protect the service against attacks.
• Payments for Premium are handled by our merchant of record; we never see your card details.
• Our AI provider receives only the minimum needed, never your saved values or the answers people give, and doesn't keep it or train on it. Free-plan detection never leaves our server.
• Some providers process data in other countries. Where the law requires safeguards for this, it is protected by an adequacy decision or standard contractual clauses.

Keeping and deleting

• Completed PDFs: not stored. They're made in your browser when you open one.
• Uploads never saved as a form: removed by a daily clean-up, within 3 days.
• Forms and responses: kept until you delete them. A deleted form's PDF is removed once no form or kept response uses it.
• Your account: delete it from Account, and everything in it is deleted.
• After deletion: deleted files leave storage at once. Database records can stay in our database's recovery history for up to 30 days, used only to restore the service after a fault.
• Logs: kept only as long as needed to run and protect the service.
• Recovery: the database can be restored to any point in the last 30 days after a fault.

Questions, or found a security problem?

Email support@docufillr.com with "Security" in the subject. We read every message, and we're grateful for responsibly reported issues: please give us a reasonable time to fix a problem before sharing it, and don't access other people's data or disrupt the service while testing. The full details are in our Privacy Policy.