Security and data retention

Your documents are financial records, so this page states exactly how they are handled, how long anything is kept, and what we do not claim. It describes the service as it is today, not as we intend it to be.

1. What happens to a document you upload

• The file is deleted as soon as extraction finishes, whether it succeeded or failed. It is never archived and never kept for review.
• The extracted figures are held in memory only on the processing server, and are not written to disk.
• A fingerprint of the file is kept, not the file. Each upload's SHA-256 digest — a 64-character code that cannot be turned back into the document — is stored with the job, so an identical file uploaded again within 24 hours can be recognised for its free re-run.
• The generated Excel workbook is kept for up to 24 hours so you can download it, then deleted automatically. Fetching it again requires your own signed-in session or API key, and the job must belong to your account.
• Your documents are never used to train models. Extraction sends the document's text to our AI processing provider for transcription only.

Results from a ticker lookup are different: those figures come from public SEC filings, so they are stored on your account and stay available under Extraction history until you delete the account.

2. Access to your data

• Row-level security on every table. The database enforces that a signed-in account can read only its own rows. This was verified table by table, not assumed from the policy text, and writes are restricted to the service role.
• Authorisation on the server, not in the browser. Every server function verifies your session and derives your identity from the verified token. Record identifiers sent by a browser are never trusted, so no one can read another account's extraction, job, receipt or payment by changing an identifier.
• Secrets never reach the browser. The published JavaScript bundle contains no database service key, payment secret, webhook secret or extraction backend key.
• Two-factor authentication, enforced on the server. Anyone can turn on a code from an authenticator app under Billing & account; admin accounts must. Once it is on, a session that has only given a password, an email link or Google sign-in reaches nothing until the code is entered — the check sits in the server and the database, not just the sign-in screen, so a stolen password cannot get round it. API keys are separate credentials and work without a code. If you lose your phone, support resets two-factor only after confirming the request is yours, and every reset is recorded.
• Exporting to Google Sheets asks for the narrowest access there is. If you use it, we request only the permission that covers files this app creates, so we can write the sheet we make for you and can neither read nor list anything else in your Drive. The permission is requested when you first export, used for that one request, and never stored. Nothing is sent to Google unless you press the button.

3. Payments

Card details never reach our servers. Checkout is handled entirely by a PCI-DSS certified payment processor, and we receive only a payment reference, the amount and the last four digits. Payment notifications from the processor are verified by signature, and a redelivered notification cannot charge you twice or reset your allowance a second time.

4. Transport and browser protections

• HTTPS everywhere, with HSTS asserted for a year including subdomains.
• The app refuses to be framed by other sites, declines MIME-type sniffing, restricts the referrer it sends, and switches off browser features it never uses, including camera, microphone and location.
• Sign-in, sign-up and password reset are handled by our authentication provider, which applies its own rate limits per address and per network.

5. A copy of your data, and deleting your account

You can download everything we hold about your account, as one file, from the Billing & account page: profile, plan, payments, allowances, extraction history, and the network addresses and device details recorded against it. Each part is described inside the file. Credentials such as API key hashes and payment-provider tokens are left out, and the file says what else is not included and why.

You can delete your account yourself from the same page. Deletion removes your extraction history, saved results, usage records, jobs and device signals. Your payment records are kept with the link to your account removed, because we need them for tax and accounting purposes. Any workbook still on the processing server becomes unreachable immediately, because access requires a job owned by a live account.

The Privacy Policy sets out in full what is collected and on what legal basis.

6. What we do not claim

We would rather be plain about this than let an omission imply otherwise.

• No SOC 2 or ISO 27001 certification. herodocu is a small operation and has not undergone either audit. If your procurement process requires one, we are not yet a fit.
• No HIPAA or similar sectoral compliance. The service is built for company financial statements, not personal health or similar regulated records.
• No published uptime commitment. There is no service-level agreement outside a custom engagement. Our status page shows what our own checks find, every five minutes, but it is not a promise about future availability and it is served by the same site it reports on.
• Extraction is checked, not guaranteed. Figures are transcribed as printed and reconciliation checks flag sections that do not add up, but the output is a starting point for your own review, not audited data.

7. Reporting a problem

If you believe you have found a vulnerability, write to support@herodocu.com with enough detail to reproduce it. We will acknowledge it and tell you what we intend to do. Please do not run automated scans against the live service or access an account that is not yours while testing.