DocAware Security Page

DocAware is a product of OvercomeRisk, operated by KurtzLieb Technology LLC. This page explains DocAware's security and privacy-first approach in plain English.

DocAware helps users understand contracts, leases, agreements, policies, terms, and other important documents. Because documents may contain sensitive information, DocAware is designed to reduce unnecessary document storage and limit the data needed to provide the service.

DocAware is not a law firm and does not provide legal advice.

1. Security Philosophy

DocAware's security approach is based on practical safeguards and honest communication.

We aim to:

• Collect only what is needed to provide the service
• Avoid storing original uploaded documents
• Limit access to user information
• Use trusted service providers for hosting, authentication, AI processing, and payments
• Protect information in transit
• Keep privacy and security statements aligned with actual technical behavior
• Avoid making promises the technology does not support

2. Document Handling

DocAware supports PDF, DOCX, and TXT files up to 10 MB.

Original files are parsed in the user's browser. The raw document file is not uploaded to DocAware backend storage, database storage, object storage, or disk.

After parsing, extracted plain text is sent to the server for one AI analysis request. The extracted text is not stored as original document text.

DocAware currently limits extracted text sent for analysis to 180,000 characters. Very long documents may be analyzed in part, and users should split long documents into smaller sections if they want a more complete review.

3. Saved Analysis Reports

DocAware saves generated analysis reports so users can view past analyses in their account.

Saved reports may include:

• File name
• File type
• Summary
• Risks
• Obligations
• Recommended actions
• Analysis status
• Created date and time

The saved report contains AI-generated structured analysis. It does not contain the original uploaded file or the original full extracted document text.

4. Account Access and Authentication

DocAware uses email-based authentication through the app's authentication provider.

Users are responsible for maintaining secure access to their email account. Anyone who can access a user's email account may be able to access login links or account-related messages.

If you believe your account has been accessed without permission, contact: support.docaware@overcomerisk.com

5. Access Controls

DocAware uses database access controls designed so users can only view their own account information and their own saved analyses through normal app access.

Row Level Security is enabled on public tables. User-scoped records are intended to be limited to the authenticated user who owns those records.

Authorized project owners or platform administrators with database or service-role access may technically access stored account data or generated analysis records as part of operating, maintaining, debugging, securing, or supporting the service.

6. Payment Security

DocAware uses Paddle to process paid subscriptions and credit purchases.

Payment card information is entered through Paddle checkout and is not stored directly by DocAware. DocAware stores only limited billing-related identifiers and status information needed to manage subscriptions, credits, access, and support.

For billing questions, contact: billing.docaware@overcomerisk.com

7. AI Processing

DocAware uses the Lovable AI Gateway with Google Gemini 2.5 Flash to generate analysis outputs.

DocAware sends extracted plain text from the document, truncated if necessary, and the file name for analysis. The original file is not sent as a file to the AI provider.

Provider-side retention, logging, and training behavior are governed by the applicable terms and settings of the Lovable AI Gateway and Google Gemini. DocAware does not claim that the provider does not retain or train on submitted data unless such a setting is confirmed and active.

8. Encryption and Transmission

DocAware uses HTTPS/TLS for data transmitted between the user's browser and the application.

Database storage is managed by Supabase/Lovable Cloud, which provides platform-level encryption at rest. DocAware has not added separate application-level encryption on top of the platform-managed database encryption.

No internet-based service can guarantee absolute security.

9. Cookies, Local Storage, and Tracking

DocAware uses authentication session cookies, local storage tokens, or similar technologies needed for sign-in and account access. Paddle may set its own cookies or similar technologies in connection with checkout.

DocAware currently does not include Google Analytics, Meta Pixel, PostHog, Segment, Hotjar, or similar marketing analytics tools in the codebase.

10. User Responsibilities

Users should take reasonable steps to protect their information, including:

• Uploading only documents they have the right to review
• Removing unnecessary sensitive information before upload when possible
• Keeping email account access secure
• Reviewing DocAware outputs carefully
• Consulting a qualified professional when legal, financial, business, tax, compliance, or other professional advice is needed

11. Security Limitations

DocAware uses reasonable safeguards designed to protect information, but no system is completely secure.

DocAware cannot guarantee that:

• The service will always be available or error-free
• AI-generated outputs will identify every issue
• Every risk, obligation, or questionable clause will be detected
• Unauthorized access will never occur
• Service providers will never experience failures
• User error or misuse will never expose information

12. Reporting Security or Privacy Concerns

If you believe you have found a security issue, privacy concern, or unauthorized access problem, contact us promptly:

privacy@overcomerisk.com

For general support: support.docaware@overcomerisk.com

For billing: billing.docaware@overcomerisk.com

DocAware by OvercomeRisk
Operated by KurtzLieb Technology LLC
Address available upon request