Security at fstdocs
A clearer account of how documents are handled.
Your clients may share identity, financial, and business documents with you. This page describes safeguards visible in our application and storage workflow, and is careful not to promise controls we have not verified.
For a security review, contact support@fstdocs.com.
Last updated: October 2026
The short version
- New uploads are sent directly from the client’s browser to AWS document storage and request AWS Key Management Service encryption.
- Uploaded files are checked asynchronously for malware. The application only permits downloads for uploads it considers clean.
- Download links are generated for an authorized file on demand and expire after five minutes.
- Access is checked against the active workspace and request before a download link is issued.
- Download activity is recorded in the request and document history.
01 / Document journey
How a document travels
A client opens a request link, completes the verification steps shown for that request, and selects a file. The browser uploads the file directly to AWS document storage using a short-lived upload authorization. The file does not pass through the Rails application server during that upload.
A malware scan runs after upload. Scan status is recorded and shown in the application. Downloads are not made available through the app unless the upload is marked clean and, for new storage uploads, the scanned version matches the stored version.
When an authorized workspace member requests a download, the application checks the request and upload, records the activity, and redirects to a signed download link that expires after five minutes.
02 / Encryption
Encryption
Are my documents encrypted?
New uploads request server-side encryption with AWS Key Management Service. Connections to storage use the signed HTTPS upload and download endpoints. Encryption is part of the storage workflow, not a setting you need to turn on.
What does encryption at rest mean?
Stored file contents are encrypted by the storage service. Encryption helps protect stored data, but it does not prevent the application from processing a document when an authorized user accesses it.
Can fstdocs access my documents?
The application can make a document available to an authorized workspace member, so we do not describe the service as end-to-end encrypted or claim that fstdocs is technically unable to access files. Access is mediated by application authorization and download checks.
Do you offer end-to-end encryption?
No. Files are processed for malware scanning and made available through the application after authorization. That workflow is not compatible with a claim that only the client and recipient hold the decryption capability.
03 / Access
Who can see your documents
Who can download a document?
The application checks the active workspace, request, and upload before creating a download link. The link is for one file and expires after five minutes. It is time-limited, but it is not described as single-use.
Can another customer access my files?
Requests are scoped to the current workspace and downloads are checked against the owning request. A request outside that authorized scope is not returned as an available document.
Do you record downloads?
When the application generates a download link, it records download activity against the document and request, including the user and time. The web request log also records the requesting IP address. This is an application audit trail, not a guarantee about the retention period of every log.
Do clients need an account?
Clients use the request link and the verification flow presented for that request; they do not need a workspace account to upload documents.
What if a request link is shared?
Treat the link as sensitive. Anyone who has it may reach that request’s client flow, subject to the verification steps enabled for that request. Contact support if you believe a link has been exposed so we can advise on the request.
04 / Malware protection
Malware protection
Are uploads scanned?
New uploads are submitted to an AWS-managed malware scanning workflow. The result is processed asynchronously and reflected in the file’s scan status.
Can I download a file before it is cleared?
The application refuses to generate a download link unless the upload is marked clean. We do not claim that an AWS storage policy independently enforces this for every stored object.
What happens if a file is infected or cannot be scanned?
Files marked infected, unsupported, or in an error state are not available for download through the application. Ask the client to provide a supported, clean copy. The interface reports when a file could not be scanned.
05 / Data and service limits
Your data, over time
Where is document storage located?
The application’s configured document storage uses AWS infrastructure in the United States. Contact us for current processing and subprocessor details before completing a formal review.
How long are documents retained?
Retention depends on account and request lifecycle terms. This page does not promise a universal deletion deadline, backup schedule, or recovery period. Contact us for the terms that apply to your account.
Are documents used by AI features?
The document-handling workflow described here covers request creation, upload, malware scanning, and authorized download. Contact us before enabling any integration or feature that would process customer documents in another way.
Do you have SOC 2 or HIPAA certification?
We do not make a SOC 2 or HIPAA compliance claim on this page. If either is a requirement, contact us before uploading regulated information so we can discuss fit and current documentation.
06 / Contact
Questions or vulnerability reports
For a security questionnaire, privacy question, or suspected vulnerability, email support@fstdocs.com. Please avoid including customer documents, credentials, or other sensitive data in your report.
We appreciate responsible reports and ask researchers to avoid accessing other customers’ data or disrupting the service while reporting an issue.
Subprocessors and operational controls can change. Contact us for current information relevant to your review.