Three questions decide most security reviews: who else sees our content, where does it live, and what happens when a document tries to give the assistant orders. This page answers all three specifically, and says plainly where an answer depends on your contract rather than on our architecture.
Every AI service that sees your content is named here. All of them are Google services or DocFila's own infrastructure — no other AI vendor receives your documents.
Document analysis, extraction, chat and OCR escalation. Called from DocFila's server functions at generativelanguage.googleapis.com, using a key held in Google Secret Manager that never leaves the server.
Search indexing. When a document is saved, its text is sent to us-central1-aiplatform.googleapis.com to build the embeddings that make your library searchable. This runs on every save.
A few in-app features call a model directly from the app through Firebase AI Logic (firebasevertexai.googleapis.com) rather than through our server: image generation, design-from-reference, and some document enrichment. The app carries no model key; access is mediated by your Firebase session.
Some builds route prompts to an open-weights model DocFila runs itself on Google Cloud Run. That is our infrastructure, not a third-party AI vendor.
No OpenAI, Anthropic, or other third-party model provider receives your documents. Models in use are Google's Gemini, Gemma, Imagen and text-embedding-004.
Shipped clients contain no Gemini or Vertex API key. A build gate scans release bundles and a test asserts the key and the Gemini REST host are absent from client artifacts.
DocFila does not train, fine-tune, or evaluate any model on your content. There is no training pipeline in the product. Your documents are indexed for search — that is retrieval over your own library, not training.
The AI proxy functions forward your request and return the answer without storing the prompt or the response.
Where the point of a feature is to produce something durable — a summary, extracted invoice fields, tags, a schedule brief — that result is saved to your document, because that is the feature. The distinction we draw is between keeping a result you asked for and keeping a transcript of the request.
When a provider returns an error, DocFila logs the error's own status code — PERMISSION_DENIED, NOT_FOUND, RESOURCE_EXHAUSTED — and never the error body, because provider error bodies can quote the request back. This covers every function that sends your content to a model, including the embedding path.
Scanned-page text recognition for Latin, Chinese, Japanese, Korean and Devanagari runs on your device and reaches no network. Scripts with no on-device model — Arabic, Cyrillic, Greek — are escalated to the model only after every on-device pass returns nothing, and only for signed-in members, never for guest sessions.
Being straight about the exception: PDF parsing and invoice extraction send the document itself when on-device extraction yields too little text to work with. That is a different path from the scanner, and it is not limited to scripts we cannot read.
What Google retains, and whether prompts may be used to improve its models, is set by the terms for the tier each service runs on. We supply the governing terms and the tier in the data-flow review rather than summarising them here, because that part is contractual rather than architectural.
Regions as configured today, including where they differ between the file and its text.
The files themselves are stored in Google Cloud Storage's EU multi-region.
The extracted text of a document, along with its summary, extracted fields and all application metadata, is stored in Firestore's nam5 United States multi-region. So while the file is in the EU, the text taken out of it is in the US. We state that plainly rather than let "documents are in the EU" imply more than it should.
Embeddings are generated by Vertex AI in us-central1 and the chunks are stored alongside the rest of your data in nam5.
Server functions — the AI proxies, import, export — execute in us-central1, so content processed by a function transits the United States even when the file at rest is in the EU.
If your obligations require EU-only processing, raise it during review: this is a deployment configuration, not a product limit. Residency obligations become commitments only when written into an executed agreement.
DocFila's workspace agent reads documents other people put in a shared workspace, and any of them can contain text addressed to the model. The controls below are the workspace agent's, described for that surface specifically rather than asserted across the whole product.
A workspace skill may ask for a folder and can never name one: no tool declaration has a path, folder or directory parameter for a model to fill in. The person chooses the folder in the operating system's own dialog, and that choice is the scope of what the agent may read.
Sending email and notifying members are blocked until the person confirms that specific call. Each blocked action becomes its own confirmation card, and a model-supplied confirmation_granted argument is stripped before the executor sees it — the model cannot grant itself permission by adding the field.
The workspace confirmation card renders every non-empty argument in full, with no truncated fields and no hidden parameters, so an instruction smuggled into a long body cannot hide in a value the screen declined to display.
The intent to send is written to the workspace audit trail before anything reaches a recipient, with a SHA-256 fingerprint of the message. If that record cannot be written, the send does not happen — DocFila refuses rather than performing an irreversible action it could not account for.
Text extracted from a document is passed to the model as material to work on. A document is never treated as a source of instructions about what the agent should do next.
These are the workspace agent's controls. DocFila's other assistant surfaces have their own, narrower confirmation model — we will walk through any specific surface in a review rather than imply one posture covers them all.
DocFila does not publish a SOC 2 or ISO 27001 report. The controls above are implementation evidence, not a certification, and this page does not imply one. See the Trust Center for current assurance status.
Provider retention terms, residency obligations, and deletion periods bind only through an executed agreement. Everything described as configuration is what runs today and can change; we give 30 days' notice for new subprocessors.