Security
Security is the product, not a feature
doxio is built around a short list of non-negotiables — enforced in code, asserted in tests, and reviewed adversarially.
Strict tenant isolation
Every query is scoped to your organization from a server-validated session with a membership re-check. A client can never reach another tenant's data.
Hashed secrets & OTP access
Share tokens and one-time codes are stored only as hashes and compared in constant time. External access always requires a fresh emailed code.
No raw file URLs
External recipients receive bytes only through a share-scoped, rate-limited stream. We never hand out raw or presigned object URLs.
Version-pinned, immutable signing
The signer signs the exact shared version, verified by checksum. Signing is transactional and race-safe; the signed copy can't be altered or regress.
Append-only audit log
A per-organization, hash-chained audit trail makes any tampering evident. The log can only ever be appended to — enforced by a database trigger.
Verified billing & strict CSP
Entitlements flip only on cryptographically-verified payment webhooks. A nonce-based Content-Security-Policy locks down what can run in the browser.
Infrastructure
doxio runs on Railway, EU-pinned — PostgreSQL and object storage are hosted in EU regions and access is least-privilege. Payments are handled by Stripe; email by Resend.
View our sub-processorsHonest about what a signature is
A doxio signature is a clear visual signature backed by a full audit trail — not a qualified PAdES cryptographic signature. It suits most business agreements; for qualified signatures, consult your legal counsel.