How we protect your documents.
What we do to protect your documents, stated plainly. Each item below describes how VersoDocs works today; anything not available yet is marked as planned.
Stored in the EU.
Database in Frankfurt
Organization and document data live in Neon managed PostgreSQL, in the AWS eu-central-1 region (Frankfurt, Germany). Sign-in is handled by Clerk, outside the EU.
Files in Western Europe
Uploaded images and files are kept in Cloudflare R2, stored in Western Europe.
Served by Cloudflare
The app runs on Cloudflare Workers, on Cloudflare’s global network, so pages load close to your readers.
Some services sit outside the EU
Sign-in (Clerk) and the optional AI features use providers outside the EU. Every sub-processor, and what it receives, is listed in the privacy policy.
Encrypted in transit and at rest.
In transit
All traffic to versodocs.com is served over HTTPS (TLS), and the app connects to its database over TLS.
At rest
The database and file storage are encrypted at rest by our storage providers, Neon and Cloudflare R2.
Secrets encrypted again
AI provider keys you bring and export credentials are encrypted with AES-256-GCM before they are stored. API keys and OAuth tokens are kept only as hashes.
A record nobody can quietly rewrite.
Changes go through proposals
The live document cannot be edited directly: every change is drafted as a proposal, and admins can require approval before it is published. Published versions are locked and cannot be edited or deleted, short of deleting the whole document or organization.
Who wrote, reviewed and approved
Every version keeps its author, reviewers, approver, reason and date. An admin override to publish an urgent fix is recorded on the version.
Org-wide audit logPro
A log of activity across the organization, kept in full on Pro, with CSV exports for your auditor.
E-signature on approvalPro
Require people to re-authenticate before they approve or publish, with the signature meaning, signer, time and method recorded. It is not a validated 21 CFR Part 11 system.
People and agents see only what they should.
Roles
Organization owners, admins, members and viewers; workspace admins, editors and viewers.
Private workspacesTeam
A private workspace is visible only to its own members, and connected agents never see one their member cannot open.
Scoped, revocable API access
API keys and connected apps only do what their scopes allow, are limited to one organization and can be revoked at any time, effective immediately. On Pro, a key can also be limited to one workspace.
SSO and SAML
Planned, not available yet. Sign-in today goes through Clerk, our authentication provider.
Your docs never train a model.
No training on your content
We do not train AI models on your documents. AI features send content to a model only to produce the summary or review you asked for.
Organization switches
Admins can turn off “Allow VersoDocs AI” (Team and Pro) and “Allow AI agent connections” (every plan) for the whole organization.
DeepSeek opt-outTeam
Hosted AI runs on Cloudflare Workers AI, then Groq. An admin can make sure content is never sent to the last-resort fallback, DeepSeek.
Bring your own AI keyTeam
AI reviewers can run on your organization’s own provider key, stored encrypted and used only for the reviews you configure.
Built in France, under GDPR.
GDPR applies
VersoDocs is published by Alex Quach in Paris, France, and handles personal data under the GDPR.
Your rights
Ask to access, correct, export or delete your personal data, or object to processing, and we will respond within the time the law requires.
Sub-processors
Every company that processes data for us, and what it receives, is listed in the privacy policy.
Leaving is easy
Export any document to Markdown on every plan. Deleting an organization removes its data from our active systems.
Report a vulnerability
Found a security issue? Email support@versodocs.com with the details and steps to reproduce. Please give us a reasonable chance to fix it before telling anyone else, and do not access or change other people’s data while testing. We will confirm we received it and keep you posted.
VersoDocs does not hold SOC 2 or ISO 27001 certification today. If your review needs more detail than this page, email us and we will answer your questionnaire.
Start with one document.
Free for two people, with the full review workflow. No card needed.