Security · data · privacy
Where your borrowers' documents go
Before you hand a driver's license or a W-2 to a tool, you should know where it is stored, who reads it and when it is gone. Here are the answers, in plain English.
What is in place today
- Private, encrypted storage: no file is ever publicly accessible.
- Time-limited signed links to open a file, and a client upload link valid for 14 days.
- Strict account isolation: a professional only ever sees their own files.
- No AI training on your documents.
- Delete at any time: a file or your whole account, documents and checks included.
- No automated decisions: dossaia flags issues, you decide. It never scores, ranks or approves anyone.
From upload to deletion
1. Upload
Your client gets a personal link, no account needed, and uploads their documents. Files land in your account's private storage.
2. Check
To check a document, dossaia sends it to its AI subprocessor, Anthropic (Claude model), which processes it in the United States for the duration of the check.
3. Follow-up
If something is missing, the follow-up email goes out through our email provider (Resend). It names the missing item and never attaches a document.
4. Delivery
You open the file from your dashboard. ZIP exports are deleted automatically 7 days after they are created.
Who is involved, and where
| Provider | Role | Location |
|---|---|---|
| Anthropic | Document checks (Claude model) | United States |
| Supabase | Database, accounts and file storage | Files stored in the EU |
| Vercel | Application hosting | United States |
| Resend | Emails (upload link, follow-ups, notifications) | United States |
| Stripe | Payments and billing | Card data never touches our servers |
| Upstash | Rate limiting (IP address) | Abuse protection |
Full list and your rights, including California privacy rights: Privacy Policy.
What compliance teams ask
Do my borrowers need an account?
No. They get a personal link, valid for 14 days, and upload from any device. You can issue a new link at any time.
Are documents used to train AI?
No. Anthropic, our AI subprocessor, does not use these documents to train its models. We never sell them or use them for advertising.
How long do you keep files?
Until you delete them, which you can do at any time from your dashboard. Deleting a file erases its documents, checks, summary and email log. ZIP exports delete themselves after 7 days.
Does dossaia detect fraudulent documents?
No, and we would rather say so. dossaia checks completeness, legibility, validity and consistency across documents, and flags discrepancies. It does not authenticate a document or label anyone a fraudster.
Do you hold a certification (SOC 2, ISO 27001)?
Not today. This page describes what is actually in place rather than a badge. For a specific question from your compliance team: contact@dossaia.fr.
Try it on one redacted file
Send a file with names masked: within 24 hours you get, in writing, every missing, expired or inconsistent document.