Security grounded in verifiable controls

Concrete controls. Explicit limits.

Formatara is designed so every document has an owner, logical segregation by account and document, authenticated access and manual deletion. We do not claim certifications or guarantees that have not been audited.

Technical review: August 13, 2026. This describes controls observed in the current environment; it is not a certification or contractual commitment.

Access and isolation

Upload, viewing, export and deletion routes verify identity on the server. Objects are stored with per-user and per-document prefixes; no object key becomes a public URL. Current API keys do not have scopes: they grant full access to the account's documents until revoked.

File validation

A declared size can be rejected before the file is received; full validation runs after the upload is read.
Multi-page documents and large files are supported; the processor keeps a technical ceiling of 500 pages and 200 MB per document.
Binary signature verification, not just the extension or browser MIME type.
Formats restricted to PDF and recognized image types.
Sanitized names and responses with nosniff.
No URL uploads, preventing SSRF through user input.

Processing

Processing is configured in a service separate from the site, with service-to-service authentication, per-account limits and response format and size validation. Network privacy, residency, logs and retention for the actual operator must be verified before sensitive documents are processed.

Data and retention

Files are used only to provide the service. Metadata and files are stored separately and isolated by account and document. Users can delete a document and its results from the application.

Applied retention: each document receives an expiration date based on the plan. A periodic process reconciles reservations and deletes files and results in batches; an operational delay may occur before purging is complete. Users can request manual deletion from the application.

Payments

Stripe hosts Checkout and Customer Portal. Formatara is not designed to receive a full card number. Webhooks verify signatures against the raw body, and the flow uses keys and records to avoid applying the same event twice; these controls must be revalidated when payments are enabled.

What we do not claim

We do not claim SOC 2, ISO 27001 or ENS certification, or that the service has been assessed or contractually enabled for HIPAA. We also do not claim SSO, an SLA or guaranteed regional residency. The Business plan does not enable those controls by itself.

Report an issue

Email security@formatara.com with the impact, reproduction steps and a secure way to contact you. Do not attach personal documents.