1. Infrastructure and Hosting
- Our application and database are hosted on Railway, which is SOC 2 Type II and SOC 3 certified. Their reports and current certification status are published at trust.railway.com.
- All customer data within our Railway project, including the managed Postgres database, is encrypted at rest.
- All traffic between your browser and our service uses TLS (HTTPS).
- Connections between our application and its database are encrypted in transit in production.
- Our database and application are deployed in Railway's EU region (europe-west4, Netherlands). Candidate data held in our database is stored in the EU.
2. Backups and Disaster Recovery
- Point-in-time recovery (PITR) is enabled. Continuous write-ahead log archiving allows us to restore the database to a recent point in time in the event of an error or failure.
- Daily backups, retained for 6 days.
- Weekly backups, retained for 1 month.
- Backups are encrypted and stored on the same infrastructure as the live database.
- Backup data is not accessed or used for any purpose other than restoring service in the event of data loss or error.
3. Where Candidate Data Lives
- Our database holds candidate contact details, document metadata (filename, type, dates) and document status and tracking information. It does not keep document files, with the one short-lived exception below.
- Where you have connected an ATS, each document is attached to the candidate's record in that system. Without an ATS, documents are delivered to your own Google Drive, in a Drive you own and control. With an ATS connected, Google Drive is optional: if you connect it, it only receives a file your ATS could not take, so that file is not lost.
- Files pass through our servers in memory, in transit between the channel a candidate sent them on and your ATS or Drive.
- The exception: a file waiting for its virus scan. If our scanner is briefly unavailable when a file arrives, we hold that file in our database instead of letting it through unscanned (see File Screening). It is deleted once it has been scanned and filed. If filing it never succeeds, it is deleted after 30 days.
4. File Screening
Yes, GettingDocs scans every file for viruses itself. It does not rely on Google Drive or your ATS to do it.
Every file a candidate sends is screened before anything else happens to it: before any AI looks at it, and before it is filed to your ATS or Drive. Screening is a security control rather than part of the document check, so it runs even if you have switched document checking off.
Each file passes three checks, in order:
- Its name and declared type. Programs, installers, scripts, shortcuts and disk images are refused on sight:
.exe,.msi,.bat,.ps1,.js,.sh,.dmg,.apk,.isoand similar. A disguised name such aspayslip.pdf.exeis refused too. - Its contents. We read the first bytes of the file, which say what it really is whatever it is called, and refuse anything that is a program. Password-protected PDFs, Word and Excel files, compressed archives and empty files are refused here as well, because nobody at your end could open them.
- A virus scan. Files that pass are scanned by ClamAV, an open-source antivirus engine whose virus definitions are updated automatically. It runs on our own infrastructure on a private network with no public address, so files are not sent to a third party to be scanned.
A refused file is never filed to your ATS or Drive and never shown to an AI model. The candidate is told why, in plain words, and asked for a different copy, and the document stays on their list of what is still needed. Where a file is flagged by the virus scan, you are told it was "flagged by our security check" and a note is left on the candidate's ATS record.
If the scanner is unavailable, files are held rather than let through unscanned. The candidate is told the file is being checked over, the scan is retried every few minutes, and you are told if a document is delayed for more than a day.
No scanner can promise to catch everything, and this does not replace the antivirus protection on your own devices. What it does mean is that program files never reach you through GettingDocs, and every file that does has been checked first.
5. AI Processing
We use Anthropic's Claude API on the commercial API tier - not the consumer Claude.ai product - to draft chase messages to candidates, interpret their replies, work out which of the outstanding documents a candidate has just sent, and check each document is the right one and can be read.
- What is sent. Classifying a reply uses the candidate's message text, the conversation history, the filename, and the list of documents that candidate still owes.
- Document files, when the document check is on. The check is on by default. With it on, each document a candidate sends is also sent to Anthropic so it can be checked for legibility and for being the right document: images and PDFs as the file itself, Word, Excel and PowerPoint files as their extracted text. It can be switched off for your whole account in Settings → Document Checking; with it off, document files are never sent to Anthropic.
- Anthropic does not use commercial API inputs or outputs to train its models by default.
- Our Anthropic account runs on their organization default retention: inputs and outputs are retained for 30 days, then deleted.
- A Data Processing Agreement is in place with Anthropic, automatically incorporated into their Commercial Terms of Service.
6. Candidate Communication Channels
Candidates are contacted over WhatsApp, through Twilio's WhatsApp Business API, and by email, sent from your own verified domain through Resend. Candidate replies, including document attachments, are received back through the same two channels.
Candidates are never asked to create an account, log into a portal, or set a password with us.
7. Subprocessors
| Subprocessor | Purpose | Data types |
|---|---|---|
| Railway | Hosting, database, and backups | All candidate and account data held in our database |
| Twilio | WhatsApp messaging | Candidate phone numbers, message content, and any documents candidates send over WhatsApp |
| Resend | Candidate email - sending and receiving | Candidate email addresses, message content, and any attachments they reply with |
| Brevo | Transactional email to you as the account holder | Account holder email address, notification and alert content |
| Anthropic | Message generation, reply classification and document checks | Candidate message text, conversation history, document filenames and the documents still owed. With the document check on (the default), the document file itself, so it can be checked. The check can be switched off per account. |
| Google Drive | Document storage, in a Drive you own and control | Candidate document files |
| Stripe | Payment processing | Billing details, entered on Stripe’s own checkout. We retain only a Stripe customer ID. |
| Your ATS (Recruit CRM, Crelate, Zoho Recruit or JobAdder) | ATS sync, where you connect one | Candidate records, document files, and document metadata |
This list is updated as we add new integrations. Last updated: 29 August 2026.
8. Deletion and Data Subject Rights
You can delete your data at any time from the Settings page, under "Danger Zone" - documents, clients, or your whole account. This removes your data from our live systems immediately.
A copy may remain in our backups for up to 1 month, which is the longest window under the daily and weekly backup schedule described above, after which it is automatically and permanently removed as part of our standard backup rotation. Backups are not used for any purpose during this period other than disaster recovery.
The full set of rights available to you, and how to exercise them, is set out in our Privacy Policy.
9. GDPR and Data Processing Agreements
Under the GDPR (the EU GDPR and the UK GDPR), the agency that uses GettingDocs is the controller of its candidates' personal data, and GettingDocs acts as its processor: we process candidate data only on the agency's instructions, to collect and file the documents it asks for. For the account holder's own details, such as login and billing information, we act as controller, as described in our Privacy Policy. Our terms as your processor are set out in our Data Processing Agreement, described at the end of this section.
A Data Processing Agreement is in place with each of the subprocessors that handles personal data on our behalf:
- Railway - hosting, database and backups
- Anthropic - AI processing
- Twilio - WhatsApp messaging
- Resend - candidate email
- Google - Drive document storage
- Brevo - account holder email
Our own Data Processing Agreement with you, covering our role as your processor, is available on request - contact [email protected].
10. Certifications
Our hosting provider, Railway, holds SOC 2 Type II and SOC 3 certification. Our infrastructure therefore runs on certified hosting, and their current reports are available at trust.railway.com.
To be clear about what that does and does not mean: this is our hosting provider's certification, inherited through the infrastructure we run on. GettingDocs is not itself independently SOC 2 certified. We would rather say so plainly than imply a certification we do not hold.
11. Questions
If you are evaluating GettingDocs and need detail that is not covered here, or you have found something on this page that looks wrong, please get in touch:
- Email: [email protected]
- Support: Contact Form