Security
How your data is protected.
We would rather tell you exactly what is in place than show you badges we have not earned. Here is each protection, in plain words.
Status by protection
Where each protection stands.
| Protection | What it means | Status |
|---|---|---|
| Certificates read in your browser | Dates are read from PDFs on your computer; only the file you confirm is uploaded. | In place |
| No tracking cookies | This site sets no tracking or advertising cookies, and fonts are served from our own host. | In place |
| EU hosting | Your records and documents are stored in the European Union (Frankfurt). | In place |
| Encryption | Data encrypted in transit and at rest. | In place |
| Separation between customers | Each customer's data is isolated in the database itself, with automated tests that check it. | In place |
| Private document storage | Documents stored privately and opened only through short-lived links. | In place |
| Expiring upload links | Contractor links open one renewal only and stop working after 21 days. | In place |
| Two-step sign-in | An authenticator code at sign-in, enforced by the database, not just the screen. | In place |
| Backups | Daily encrypted backups kept off-site, with restores tested. | Planned |
| Data processing agreement | A GDPR data processing agreement for every customer, under legal review. | Planned |
Principles
How we make security decisions.
Honest status
We say what is in place and what is planned. We do not show certifications we do not hold.
Least access
People and systems get the access they need and nothing more, including our own team.
Your data, your control
Export at any time; delete your account and your data goes with it.
No secondary use
We do not sell your data, use it for advertising or use it to train AI models.
What we do not claim. Dueclear does not hold SOC 2, ISO 27001 or similar certifications today. The demo on this site uses example data only; your real workspace is the secure one.