Doxzo's privacy model is deliberately simple: give access to the least, keep it for the shortest time, and remove it automatically.
Only the people who need a document for a specific job can reach it.
A vendor can only access jobs where the job's vendorId matches their own record.
A customer can only access their own jobs. There is no shared document library.
Documents exist only for the duration of a print job.
The storage object is the document's only resting place, and it is removed on completion or expiry.
There is no permanent document store. History keeps metadata only, never the file bytes.
Only the metadata required for the workflow is retained.
PostgreSQL stores filename, MIME type, size, settings, status, hashed code, and timestamps, never document bytes.
Internal object IDs are generated server-side, and user filenames are never used as storage paths.
Cleanup does not depend on someone remembering.
A cleanup worker scans for expired and final-state jobs and deletes their storage objects.
Deletion happens on the backend even if no customer or vendor opens the app again.
Every state change is constrained and recorded.
The frontend can never set an arbitrary status. Transitions follow a fixed, authorized flow.
Print job events record the lifecycle so actions can be traced without retaining the document.
An honest boundary keeps the promise meaningful.
Doxzo does not claim the vendor never receives the document. Its privacy guarantee is about minimizing exposure: temporary access, scoped authorization, and automatic deletion.