Skip to main content

Security

How Docuplate protects accounts and PDF jobs

Controls that are in production today. No uptime percentage, SLA, or certification is claimed here unless it can be checked independently.

Controls in production

Account sessions
Passwords are stored as bcrypt hashes. Browser sessions use an HttpOnly cookie. Signing out increments a token version so old sessions stop working.
API keys and inbound hooks
API keys (df_) and inbound webhook tokens (dh_) are stored as SHA-256 hashes plus a short prefix. The full secret is shown once at creation.
PDF render
Templates become HTML, then Chromium prints a PDF. User-influenced HTML is sanitized. JavaScript is disabled in the renderer. Unsafe image URLs (file://, private IPs, link-local) are blocked.
Outbound webhooks
Optional pdf.generated callbacks after API generation. Destinations are checked against an allowlist to block SSRF. Failed deliveries retry a few times, then the last result is stored on the API key.
Transport and abuse limits
The app is served over HTTPS. Helmet sets security headers. Public generate, hooks, and forms are rate-limited. Plan quotas cap monthly PDF volume.
Payments and subprocessors
Card data goes to Stripe, not Docuplate servers. Hosting, database, object storage, email, analytics, and optional AI providers process data needed to run the product. See the Privacy Policy for the current list.

Current API health

GET /api/health is the live check. There is no public status page or uptime SLA yet. Incidents can be reported to [email protected].

Live check runs in the browser after the page loads

Endpoint: /api/health

Data location and requests

Docuplate is operated from Australia. Account deletion, access, and correction requests go to [email protected]. Generated PDFs use time-limited signed download URLs.

Need a security review for a Business or custom deployment? Email us with the scope.

Request a review