Built so we can’t read your documents.
Here is exactly where your data goes, how it is protected at each step, and what you can verify yourself.
On your device
Text recognition, redaction, search and the Vault run on your phone. Files are protected by iOS Data Protection and Android file-based encryption, and backups are only allowed when they are end-to-end encrypted.
In transit and in sync
Sync encrypts every page and its text with keys that never leave your devices (AES-256-GCM, X25519 + ML-KEM key exchange). TLS 1.3 protects the connection on top.
On our servers
We store encrypted blobs, file sizes and timestamps. We cannot open your documents, and neither can anyone who gains access to our infrastructure.
When you share
Share links carry the decryption key after the # in the URL, which browsers never send to servers. Links can expire, require a password and show a viewer watermark.
When you use AI
AI features ask for consent first. ID numbers are masked before anything leaves the device, providers keep no data and never train on it, and Vault documents are never sent.
For teams
SSO, SCIM, role-based access, audit logs, retention and legal hold. EU or US residency, signed DPA and subprocessor list.
Commitments
| Commitment | Status |
|---|---|
| No selling or sharing of document content | In place |
| No training of AI models on your documents | In place |
| Delete all data and export all data in the app | In place |
| End-to-end encrypted sync | With sync launch |
| Independent penetration test, report on request | Before sync launch |
| SOC 2 Type II | Planned |
| Bug bounty program | Planned |
Report a vulnerability: [email protected] · PGP key and disclosure policy at yomuscan.com/.well-known/security.txt