Security
Last updated October 24, 2026
Your data, encrypted
- All connections to WarmDoc use HTTPS with modern TLS. Plain HTTP is redirected to HTTPS.
- Your documents, account information, and engagement data are encrypted at rest.
Trusted infrastructure
- WarmDoc runs on infrastructure partners with SOC 2 Type II reports.
- Our hosting provider isolates every workspace and encrypts data at rest and in transit.
- We follow the principle of least access for all service credentials.
Account security
- Sign in with email and password, Google, or Microsoft.
- Passwords must be at least 8 characters and are stored with salted one-way hashing. We never store your password in plain text.
- Repeated failed sign-in attempts are temporarily blocked.
- Sessions use secure, HTTP-only cookies and expire automatically.
- Resetting or changing your password signs out your other active sessions.
Internal account controls
- Two-factor authentication required on all critical infrastructure accounts.
- Admin credentials are stored as production secrets, not in source code.
- Key admin actions are logged for audit.
How we handle your documents
- WarmDoc tracks engagement on documents you send: who opened, when, how long, and which pages.
- We don't send email on your behalf. You share links from your own inbox.
- Each recipient receives a unique tracked link, with no data shared across recipients.
- Recipients see your pages in a secure viewer, not your original file.
- Scanner and bot activity is filtered from your engagement data.
Email security
- SPF, DKIM, and DMARC enforced for warmdoc.io.
- Transactional email is sent through a provider with a SOC 2 Type II report.
- User-provided text is safely escaped in our email templates.
Protections against common web attacks
- A Content Security Policy is enforced across the site.
- Clickjacking protection on all pages.
- Cross-origin requests are restricted to WarmDoc.
- Rate limiting on sign-in, signup, password reset, and contact forms.
- OAuth sign-in flows are validated against cross-site attacks.
Your data, your control
- Request full account erasure from your account settings.
- Your account and related data are erased within 30 days of your confirmed request. You can cancel before then.
- File content on object storage is overwritten and made unrecoverable.
- Backups are retained by our infrastructure partners under their standard policies.
Reporting security issues
- Email security@warmdoc.io.
- We respond within 48 hours.
- We appreciate responsible disclosure. Please give us reasonable time to fix an issue before sharing it publicly.