Security you can
verify.
DocuChase encrypts documents in the client browser before upload, wraps keys to the accounting firm, and limits access with expiring sessions and firm-scoped policies.
Zero-Knowledge Document Vault
Every document is encrypted in the client browser before upload. Your firm's private key is stored only in wrapped form and unlocked for the active browser session.
AES-256 Encryption
A unique authenticated-encryption key protects each document before the file leaves the client's device.
Provider attestations, clearly scoped
Hosted on infrastructure providers that maintain SOC 2 Type 2 attestations. Designed to support safeguards described in IRS Publication 4557 without claiming that DocuChase itself is SOC 2 audited or that software alone satisfies a firm's obligations.
Each document is encrypted in the client browser with AES-256-GCM before the encrypted payload is uploaded.
Each document key is wrapped to the accounting firm's public key before leaving the client browser.
Vercel and Supabase maintain their own SOC 2 Type 2 attestations for the infrastructure services DocuChase uses.
Client upload sessions expire automatically, limiting how long a delivered link remains usable.
Security Architecture
Four layers of cryptographic defense.
Every document that passes through DocuChase is shielded by multiple independent security layers. A breach of any single layer does not compromise the others.
Client-Side Document Encryption
The client browser generates a unique AES-256-GCM key for each file and encrypts the document before upload. The encrypted document key is wrapped with the accounting firm's RSA-OAEP public key.
Cryptographic Isolation & Row-Level Security
Supabase PostgreSQL Row-Level Security policies scope authenticated access to the correct firm. Storage access uses short-lived signed URLs, while the stored document remains encrypted.
Password-Protected Firm Keys
A firm's private RSA key is wrapped in the browser with a password-derived AES-256-GCM key before storage. The plaintext vault password and unwrapped private key are not sent to the server.
Safeguard-Oriented Workflow
Designed to support safeguards described in IRS Publication 4557 and security practices relevant to a firm's GLBA responsibilities. Each firm remains responsible for its own policies, risk assessment, vendor review, and compliance program.
Regulatory Adherence
Standards we build against.
IRS Pub 4557
Safeguard-oriented design
GLBA
Supports firm controls
SOC 2 Type 2
Provider attestations
WebCrypto
Browser-native encryption
SOC 2 reports apply to our infrastructure providers, Vercel and Supabase—not to DocuChase as an independently audited organization. Customers remain responsible for their own compliance program.
Ready to secure your firm's workflow?
Give clients a direct upload path protected by client-side document encryption and firm-scoped access controls.