Doxzo minimizes access, storage time, and information exposure. This page documents the actual controls in place.
Access is enforced server-side and scoped to the exact records a user may touch.
Passwords are hashed with bcrypt at cost 12. Plaintext passwords are never stored.
JSON Web Tokens are signed with AUTH_SECRET and expire after 12 hours.
Customer and vendor roles are checked on the server. Vendors resolve to a Vendor record and can only access jobs matching their vendor ID.
Customers can only access their own jobs. There is no cross-tenant document access.
The temporary 6-digit code is the bridge between customer and vendor, protected end to end.
Codes are randomly generated and never derived from internal IDs or sequence numbers.
Only a SHA-256 hash of the code is stored in PostgreSQL. The raw code never touches the database.
Codes expire with the print job TTL and become invalid after completion or expiry.
Code entry is limited to 5 attempts per 15 minutes per client, reducing brute-force guessing.
Uploads are treated as untrusted input and validated before anything touches storage.
Uploads use memory storage with a 25 MB limit. MIME type and extension are validated.
Internal object IDs are generated server-side. User filenames are never used as storage paths.
Document contents are never logged, returned in errors, placed in URLs, or stored in the database.
Security at rest and in transit, with development conveniences clearly separated from production.
Production deployments must terminate HTTPS/TLS. The API is not designed for plaintext production traffic.
Object storage providers must use encrypted-at-rest storage. Production should use an S3-compatible provider, not the local filesystem.
Temporary access URLs, when used, are short-lived and scoped to a specific job.
Standard web defenses are applied at the API boundary.
Helmet provides security-related HTTP headers.
Cross-origin requests are restricted to configured origins.
General API rate limiting is enabled, with stricter limits for print-code entry.
Logging never compromises documents or credentials.
Document content, base64 files, document URLs, access tokens, passwords, payment secrets, or private keys. Development logs follow the same rule.