Security

Encryption

• Every connection to Reqmora, from your team and from your clients, uses HTTPS (TLS).
• Uploaded files and account data are encrypted at rest (AES-256) by our storage and database provider, Supabase.
• Data is stored in Singapore, on Amazon Web Services.

Who can see a client's files

• Files sit in a private storage bucket. There is no public folder and nothing can be listed or browsed.
• Your team opens files through signed links that expire after 10 minutes.
• The database enforces row-level security, so a firm can only ever read its own clients, requests and files.
• Each client gets a private link built on a random identifier that can't be guessed. It shows only that client's checklist, and stops working when the firm's account is deleted.

What clients can upload

• Documents and photos only: PDF, images, Word, Excel, CSV and text files.
• Each file is checked when it arrives. Anything that looks like a program or script is removed before anyone can open it.
• If the firm has the AI check on, PDFs and photos are read by Claude, from Anthropic, to check they match what was asked for. Anthropic doesn't use this data to train its models, and firms can turn the check off in Settings.

A history of every request

• Each request keeps a record of what happened and when: sent, reminded, uploaded, removed, answered, accepted or sent back for a fix.
• You can see who on your team did what, and which actions the client or the system took.

Retention and deletion

• You choose how long uploaded files are kept: 30, 60 or 90 days. After that they are deleted automatically.
• If a client removes a file, it is deleted straight away.
• An owner can delete the whole account from Settings. Client links stop at once and everything is erased 7 days later.
• If a trial ends or a plan is cancelled, data is kept for 30 days so you can return, then erased. Owners are emailed before that happens.

Team access

• Staff sign in with email and password or with Google, plus an optional code from an authenticator app (two-factor sign-in). Firm owners can require two-factor sign-in for the whole team.
• Firms have owner and member roles. Only owners can manage billing, team and account deletion.

Providers we use

• Supabase for the database, file storage and sign-in. Netlify for hosting. Resend for email. Anthropic for the AI document check. Paddle for payments, as merchant of record.
• Each provider receives only the data needed for its job. We don't sell data or use it for advertising.

GDPR

• Your firm controls its clients' data and Reqmora processes it on your behalf.
• Clients' data is used only to run the service. We handle access, correction and erasure requests, and firms can delete data themselves at any time.
• Our Data Processing Agreement forms part of our Terms, lists every sub-processor, and covers transfers outside the EU and UK with the Standard Contractual Clauses.

What we don't have yet

Reqmora is not SOC 2 certified, and it doesn't yet offer single sign-on beyond Google. If your firm needs either, tell us. It helps us decide what to build next.

Report a problem

Found a security issue, or think a client link was shared by mistake? Reach us through the contact page and we'll respond quickly. For full detail on the data we hold, see our Privacy Policy.