Security Architecture
DocEasy is engineered from first principles with client-side isolation, ephemeral processing, and authenticated vault security.
WebAssembly Memory Isolation
Document bytes are processed directly inside isolated browser WASM threads for core tools. Execution runs within client sandboxes without transmitting files.
Ephemeral Server Processing
Heavy compression pipelines (Ghostscript/qpdf) run in isolated containers. Temporary buffers exist only for execution and are purged immediately upon stream completion.
Dual Vault Architecture
Choose between an unauthenticated client session vault (Web Crypto AES-GCM 256-bit, 2-hour auto-purge) or an authenticated cloud vault protected by Supabase Postgres Row Level Security.
Open Source & Auditable
All core algorithms and client-side processing pipelines are open source for full transparency, independent review, and reproducible integrity verification.
Vulnerability Reporting
If you discover a security vulnerability or discrepancy in our client-side pipelines, please disclose it responsibly by contacting tiwari.rachit@gmail.com. We acknowledge and reward verified responsible security disclosures.