Security & Compliance

Our approach to trust

Dynamite Docs processes invoices, bank statements, credit-card statements, W-9s, contracts, and audit evidence. Encryption, access controls, and provider routing help protect that data. Review the selected provider and active policies before processing sensitive files. The private document AI guide explains browser-only files, cloud storage, provider routing, BYOK, and local Ollama.

Encryption

• All traffic is encrypted in transit (TLS).
• Stored documents and tables are encrypted at rest.
• Provider (BYOK) API keys are encrypted with AES-256-GCM before storage and are never sent to the browser.

Training and provider terms

Dynamite Docs does not use customer documents to train foundation models. Hosted and own-key requests are also subject to the selected provider's handling terms. Check the provider and routing policy before processing sensitive documents.

Free files stay in browser storage. Starter, Pro, and Scale files may remain in encrypted cloud storage until you delete them, subject to the account storage allowance and retention policy. Browser-only storage does not make hosted or own-key AI inference local. Provider trust metadata identifies backends that may train on submitted content so active routing policies can exclude them.

Access control

Every document is scoped to its owner. Anonymous viewers can only read a creator's data with that creator's private token, and file download URLs are signed and time-limited. Provider keys live server-side only.

Data residency & sovereignty

You choose the model and provider. Pro and Ultra include an EU-only data-residency policy. Hobby, Pro, and Ultra can send document bytes to the signed, loopback-only Ollama companion for local model inference; account and workspace features remain hosted. See the Privacy Policy for details.

Retention & deletion

You can delete a document, folder, or extraction at any time and it is removed from storage immediately. Anonymous processing data is swept after 7 days. On request, your data is deleted within 30 days except where law requires retention. See the data retention policy.

Subprocessors

We rely on a small set of providers for infrastructure and AI inference. Every subprocessor is contractually bound to protect your data to the standard required by our DPA.

Compliance status

Dynamite Docs is designed around the EU and UK GDPR and comparable data-protection laws, and provides a Data Processing Agreement and data-subject rights as described in the Privacy Policy.

Report a vulnerability

We take security reports seriously and will respond promptly. Please email [email protected] with the subject line "Security" and include as much detail as you safely can. Never include live production data in a test.