How we look after your clients' documents.

GarnerDocs runs on Amazon Web Services in Frankfurt, Germany. The servers, the database, file storage and backups are all in that region.

Uploaded files, files your firm shares with clients and ZIP downloads are kept in private file storage. The storage blocks all public access, and files are encrypted at rest. Each file is stored as private, and GarnerDocs never gives it a permanent web address.

When someone at your firm opens or downloads a file, GarnerDocs checks they're allowed to, then hands over a signed link to the file. That link lasts 5 minutes. Like any signed link, it works for whoever holds it until it expires.

Clients download the files you share with them the same way, from their request link, and only after entering its PIN if it has one.

If your firm sets up a webhook with download links, each link in the webhook lasts 60 minutes and downloads the file for whoever holds it, without signing in. It stops working sooner if you delete the endpoint, turn download links off, or your plan no longer includes webhooks. Only turn download links on for a system you trust, and keep its data private.

GarnerDocs checks that each upload is a file type the request accepts, by reading the file itself rather than trusting its name. Each upload is also scanned for malware with Amazon GuardDuty, in the AWS region where it's stored. Your team can open a file only once the scan finds nothing. If malware is found, the file is deleted and your client is asked for another copy. A file that can't be scanned stays blocked until an owner or admin releases it. No scanner catches everything, so open your clients' files with the same care as an email attachment.

If your firm turns on automatic document checks, each file your team can open is also read by Claude, an AI model made by Anthropic, on Amazon Bedrock in Amazon's EU regions, and compared with what you asked for. Anthropic can't access the files, and Amazon doesn't keep them after the check. What the check finds is shown only to your team, encrypted where it's stored, left out of notifications, webhooks and ZIP downloads, and deleted with the files. Checks are off until an owner or admin turns them on.

Each firm has its own workspace. Every client, request, file and note belongs to exactly one firm, and people only ever see their own firm's records.

Clients only see their own request: the documents asked for, the files they've uploaded and the notes they've added. They never see other clients or other requests.

A firm's team has three roles: owner, admin and member. Owners and admins manage the team and settings, and the owner manages billing.

By default, every role can open and download the files of every request in the workspace, including as a ZIP.

Owners and admins can restrict a request. Then only owners, admins and the members they choose can see it: its title, files, answers, notes, activity and downloads. Restricting a request needs two-factor authentication to be required for the whole workspace, and nobody can open a restricted request until they've turned it on. Webhooks send nothing about restricted requests.

Only GarnerDocs's founder can reach the production servers, database and file storage, through accounts protected by two-factor authentication.

Each request's link contains a random 48-character token. GarnerDocs keeps a hash of it to look the link up, and an encrypted copy so your team can copy the link again. The encrypted copy can only be turned back into the link with GarnerDocs's encryption key, which isn't stored in the database.

If a link is shared by mistake, reset it from the request. The old link stops working straight away.

Clients don't need an account or a password. Too many attempts at links that don't exist are refused, so links can't be found by guessing.

For sensitive requests, you can also ask for a 6-digit PIN. GarnerDocs generates it, you give it to your client yourself, and it's never in an email. After 5 wrong PINs, the next wrong attempt locks the link for 15 minutes, whatever device or network it comes from.

A link stops working when its request is cancelled, and once a completed request's files are deleted. A completed request's link also closes 90 days after completion, even if the files are kept longer.

GarnerDocs is served over HTTPS, and it tells browsers to only ever connect to it over HTTPS (HSTS). Session cookies are only sent over secure connections and can't be read by scripts on the page.

A Content Security Policy limits the scripts a page will run, and our pages can't be embedded in other sites.

The client upload pages are rate limited and kept out of search engines, and they don't pass the link on to other sites a client visits next.

GarnerDocs is for collecting documents, not archiving them. Each firm chooses how long uploaded files are kept after a request is completed: 30, 90, 180 or 365 days. The default is 90 days, and a firm confirms its choice before it sends its first request.

The firm's owner, and admins who keep these emails on, are emailed 14 days and 3 days before files are deleted. Shortening the period never deletes files with less than 14 days' notice. Until then, the firm can download a request's files as a ZIP, and owners and admins can delete them earlier.

Copies of deleted files can stay in backups for up to 30 days, until those backups expire. We don't use them for anything else.

How long files are kept explains the setting step by step.

The main events on a request are recorded in its activity history: when it was sent and opened, what the client uploaded, each reminder, each review, each link reset and each deletion, with who did it and when. Changes to the team and to the retention period are recorded too.

Every ZIP download shows there with the name of the person who downloaded it, and so does the first time a client downloads a file you shared.

GarnerDocs also keeps an access record each time someone at your firm opens or downloads a single file or a file you shared, each time a client downloads a shared file, and each time a webhook download link is used. These records aren't shown in the app yet. Client and webhook downloads are recorded without a name, because those links work without signing in: the record shows when a link was used, not who used it.

Each document keeps its review history. You can see who approved a file, when, and which version replaced which.

Passwords are stored hashed, never as plain text, and new accounts confirm their email address before using the workspace.

Each person on your team can turn on two-factor authentication in their profile settings. Signing in then asks for a code from an authenticator app as well as the password, and one-time recovery codes cover a lost phone. Owners and admins can require it for everyone: anyone without it has to set it up before they can use the workspace.

We use a small number of service providers to run GarnerDocs, such as hosting, file storage, email delivery and payments, and they only use the data to provide those services.

The subprocessors list names each one and what it does. Firms that need one can rely on our Data Processing Agreement.

If you think you've found a security problem in GarnerDocs, please tell us. Our responsible disclosure policy explains how to report it and what happens next.