Security
Architecture-based security. Not policy-based promises.
DocFort's security posture is defined by what doesn't exist — no servers holding your data, no databases, no APIs. You can't breach what isn't there.
Trust Posture
No servers holding your data
DocFort runs no backend that stores user data. Your data lives on your device and optionally in your private iCloud. There is no DocFort database to breach. The app's only request of its own is a public settings file from docfort.tech.
On-device processing
OCR runs locally via Apple Vision on your iPhone or iPad. Document images never leave your phone. No data is transmitted to any server during scanning.
2 sub-processors
Apple CloudKit (sync) and Apple StoreKit (payments). That’s the complete list. No analytics SDKs, no crash reporters, no third-party data processors.
Image destruction
Source images are permanently destroyed at the point of metadata extraction. No recovery is possible. The only data retained is extracted text (names, dates, numbers).
What We Don't Have
The following components do not exist in DocFort's architecture. They cannot be compromised because they were never built:
Encryption
At rest
iOS Data Protection encrypts on-device data. Requires passcode or biometric to access.
In transit
Synced data travels encrypted to your private iCloud database, which we cannot access. With Advanced Data Protection on, it is end-to-end encrypted.
Team Data Boundaries
In Team plans, admins see compliance status (current, expiring, expired) — never the document itself. Each employee's scanned data stays on their own device. The admin dashboard shows aggregated status, not source material.
Compliance
DocFort has not completed a SOC 2 audit. The controls above describe how the app is built; they are not a certification.
Responsible Disclosure
If you discover a security vulnerability, please report it to us. We will acknowledge your report within 48 hours and work to resolve the issue promptly.
Contact & Resources
For security inquiries or to report a vulnerability: .