Security
Your documents deserve
serious security.
JeScan stores your most sensitive documents — IDs, contracts, medical records, financial statements. We treat security as a core product feature, not an afterthought.
Encrypted storage
Every document you upload is stored encrypted at rest on Cloudflare R2 — a globally distributed, S3-compatible object storage service built by Cloudflare. Your files are never stored unencrypted, not even temporarily during processing.
Signed URLs with expiry
Documents are never publicly accessible. When you view a document, JeScan generates a signed URL that expires after 15 minutes. Even if someone intercepts a URL, it becomes useless after expiry. No permanent links to your files exist on our servers.
Data isolation
Every database query includes your user ID as a filter — it's impossible for one user to access another user's documents. For Team workspaces, documents are isolated by organization, and access is controlled by role (Owner, Admin, Member, Viewer).
Privacy-first AI processing
When AI processes your documents, we send the text content to Anthropic's Claude API for classification and metadata extraction. Anthropic does not use API inputs to train their models (per their data processing agreement). OCR can run client-side in your browser via Tesseract.js — meaning the raw file bytes never leave your device before text extraction.
HTTPS everywhere
All communications between your browser and JeScan are encrypted via HTTPS with TLS 1.2+. We enforce HSTS (HTTP Strict Transport Security) with a max-age of 2 years, preventing downgrade attacks. Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) are set on every response.
Authentication
JeScan uses Google OAuth via Auth.js (NextAuth v5) for authentication. We never store your password — authentication is delegated entirely to Google. Sessions are managed with secure, httpOnly cookies that expire after 30 days of inactivity.
Payment security
Payment processing is handled entirely by Stripe. JeScan never sees, stores, or processes your credit card number. Stripe is PCI DSS Level 1 certified — the highest level of payment security certification.
Data deletion
Deleted documents go to Trash for 30 days, then are permanently removed from both the database and R2 storage. When you delete your account, all data is permanently erased within 30 days. You can export all your data at any time from Settings.
Additional security practices
- ✓Server-side input validation on all API routes
- ✓MIME type verification (not just file extension)
- ✓File size limits enforced server-side (20 MB max)
- ✓Rate limiting on authentication and upload endpoints
- ✓Content Security Policy (CSP) headers
- ✓No third-party tracking pixels or advertising cookies
- ✓Regular dependency updates and vulnerability scanning
- ✓Standalone deployment on our own infrastructure (not shared hosting)
Responsible disclosure
Found a security vulnerability? We take every report seriously. Please email us at security@jescan.me with details. We'll acknowledge within 48 hours and keep you updated on the fix.
Please do not publicly disclose vulnerabilities before we've had a chance to fix them.