Everything below is implemented in the running code, not aspirational. Where a control has a known limit, the limit is stated rather than omitted.
Identity and access
Passwords are hashed with PBKDF2-SHA256 at 210,000 iterations and a per-account random salt. Verification is constant-time.
Sign-in issues a 256-bit random session token; only its SHA-256 hash is stored. The cookie is HttpOnly, SameSite=Lax, and Secure over HTTPS.
Sign-in, sign-up, and password reset are rate limited per IP and per email address, with lockout windows.
A password reset revokes every session for the account. Changing your password from the account page revokes every other session.
Every case read and write resolves ownership against your account in the database before returning data. A foreign case is indistinguishable from a missing one.
Upload handling
Files are limited to 12 MB, with a 100 MB and 50-document ceiling per review.
Type is determined from the file signature, not the declared MIME type or the filename. A mismatch between signature, extension, and declared type is rejected.
Container integrity is checked: truncated files and bytes appended after a PDF end marker are rejected.
Encrypted PDFs and PDFs containing JavaScript, embedded files, launch actions, or rich media are rejected before any parsing.
Local PDF parsing is capped at 200 pages. AI review is separately opt-in and sends only a bounded set of rendered pages or the selected image; without consent or a configured provider, images route to manual review.
Data handling
Documents and reports are stored under random, case-scoped object keys and are never exposed as public URLs.
Private responses set no-store caching, nosniff, and a per-request trace ID. Document downloads are served with a sandbox content-security-policy.
Responses carry a strict CSP, frame-ancestors none, HSTS over HTTPS, and a restrictive permissions policy.
Mutating requests are rejected when they originate cross-site, and destructive or expensive operations require an idempotency key.
Audit events record opaque identifiers, stages, counts, sizes, and versions — never names, wages, excerpts, or file contents.
Analysis boundary
Uploaded content is treated as untrusted evidence, never as model instructions. AI responses must pass a strict schema, page bounds, candidate limits, and a separate grounding pass.
Only verifier-supported AI candidates enter the review queue, and they remain unusable by analysis until a person confirms or corrects them. Provider failure falls back to local parsing or manual review.
Findings are produced only by pure, versioned rule code from facts you reviewed. Document text cannot invoke a tool, change policy, or publish a status.
All money arithmetic uses integer cents or exact rational arithmetic. Aggregate expectations are rounded once, after aggregation.
Reports are rebuilt from an allowlist of structured fields. Original document layers are never copied, so excluded content is absent rather than covered over.
Redaction rewrites matching identifiers across every included field and excerpt before the PDF is produced.
Reporting a vulnerability
Email dgbhanderi20@gmail.com with the affected route, the build version, and a minimal reproduction using synthetic data.
Never include real records, another person's data, or credentials in a report. Please give us a reasonable window to remediate before public disclosure. We do not pursue legal action against good-faith research that respects these boundaries.
Known limits
Uploads are not scanned by an antivirus or content-disarm engine. Structural validation is not malware detection.
There is no second authentication factor yet. Account safety rests on your password.
AI extraction and verification can be wrong or incomplete. A verifier-supported citation is not proof that the value or interpretation is correct.
Render PostgreSQL uses provider encryption at rest; WageShield does not add customer-managed keys.
Paid Render PostgreSQL point-in-time recovery can retain a recoverable prior database state for up to three days on this Hobby workspace, as disclosed in the Privacy policy.
An independent penetration test and privacy assessment have not been performed on this build.