Security & data handling

Every template and render belongs to exactly one workspace. An API key is scoped to one workspace and is refused (403) for any other workspace's templates.

Keys are revocable from your dashboard at any time. Every request is logged with its request id, visible to you in the dashboard.

Data you send is used to produce the document. Rendered files are stored in your workspace and served through a CDN; you can choose not to store a render by taking the bytes in the synchronous response.

Managed Postgres for account data, object storage with CDN delivery for files, and dedicated render servers. Staging and production run on isolated storage.

Webhook deliveries are HMAC-signed so you can verify they came from us, and are retried automatically.

Card and subscription payments are handled by our payment provider (Razorpay). We do not store card numbers.

We do not hold SOC 2, ISO 27001 or similar certifications yet, and we will not imply otherwise. A DPA or security questionnaire can be discussed on request.

For deletion of your workspace data or a specific retention requirement, contact support@pixldocs.com. See also the privacy policy.

Security concerns: support@pixldocs.com.