SOC 2 Type II
In progressSOC 2‑aligned controls have operated since October 2025, with dated evidence: access and security‑event reviews, restore tests, and disaster‑recovery and incident‑response exercises. The audit report is not issued yet.
Instafill.ai Trust Center
How we protect the information you put in your forms.
Where your documents and form data are stored, how they are encrypted, who can see them, which providers process them, and what happens if something goes wrong. Every statement here is backed by a written policy, a contract term or independent testing.
- US‑stored
- Microsoft Azure, Texas
- AES‑256
- At rest, plus keys unique to your workspace
- 48 hours
- Written breach notice to you
- Nov 2025
- Independent penetration test
Compliance and assurance
Penetration test
CompletedTwo‑week white‑box test by Iterasec (November 17–28, 2025) of the production app and both APIs, with source‑code access, against OWASP and CWE Top 25. The December re‑test confirmed the one Critical and four of five High findings fixed; the fifth High was reduced to Low.
Data Processing Addendum
AvailableOur security measures, provider list, 48‑hour breach notice, the ban on AI training and deletion when you leave, in a contract you sign with us.
Security questionnaires
AvailableA completed SIG Lite is ready to send. If your compliance team, IT department or cyber carrier has its own questionnaire, send it and we'll complete it.
What we commit to
- Never sold, shared or used to train AI. Your content is used only to fill your forms. That's in our contract with you and in our AI providers' business terms.
- Stored in the United States. Documents and form data are stored in Microsoft Azure's South Central US region in Texas.
- Encrypted twice. HTTPS on every connection and AES‑256 at rest, plus a second layer with keys unique to your workspace, held in Azure Key Vault.
- Yours to delete. Delete documents at any time, or have your workspace delete them automatically after the number of days you choose.
- A person stays in control. The AI prepares a draft. You review and edit every value before download, and nothing is submitted to anyone on your behalf.
- Told within 48 hours. If a breach affects your data, we tell you in writing within 48 hours of becoming aware of it.
Security controls
Layered controls across the application, the network and our own team.
Data protection
- TLS 1.2+ on every connection
- AES‑256 encryption at rest
- Files and field values encrypted again with your workspace's own keys, held in Azure Key Vault
- Documents and form data stored in the US
- Card details go straight to Stripe and never touch our servers
Product security
- Every request checked against your workspace membership
- Two‑factor sign‑in your organization can require for every user
- Google and Microsoft sign‑in, or a verified email and password
- Roles that limit who manages members, billing and API keys
Infrastructure and network
- All traffic passes Cloudflare's web application firewall and DDoS protection
- HTTPS only
- The application runs in a private Azure network
- The database is reached over a private endpoint and never exposed to the internet
Monitoring and incident response
- Every request logged with user, workspace and outcome
- Automated alerts on anomalies and quarterly security‑event reviews
- A written incident response program: Critical incidents handled within 1 hour, High 4, Medium 24, Low 48
- Tested every year: the October 2025 exercise contained a simulated compromise in 18 minutes
Business continuity
- Daily database backups with point‑in‑time restore
- Geo‑redundant file storage and quarterly restore tests
- Recovery targets: 4 hours to recover, at most 1 hour of data lost
- The October 2025 disaster‑recovery test recovered from a simulated regional outage in 1 hour 25 minutes
- Updates at least every 8 hours during an outage longer than 4 hours
AI and your data
- Your documents and data are never used to train AI models
- For each fill, the model sees only the form and the files attached to that fill
- It never sees your other documents or other customers' workspaces
- The AI fills documents. It doesn't score, profile or make eligibility decisions about the people in your forms
Our team
- A designated Security Officer, our CEO, who approves the policies and reviews them every year
- Company accounts only, with MFA enforced
- Least‑privilege access, reviewed every quarter and revoked within 24 hours of offboarding
- Only team members who need to see your documents can, for example someone building your templates at your request, under a signed confidentiality agreement
- Security awareness training and a written code of conduct, contractors included
Devices
- Full‑disk encryption on every work device
- Automatic screen lock, antivirus and automatic updates
- No customer data on personal devices
Secure development
- Every change is code‑reviewed
- Deployed through a controlled pipeline, with test and production kept separate
- An independent penetration test every year
- Critical and High findings fixed within 30 days
Retention and deletion
Your data is yours. Everything you upload and everything the service generates belongs to you, and we use it only to provide the service.
| Data | Kept | Then |
|---|---|---|
| Documents and form data | Until you delete them, or for the number of days you set | Securely deleted within 30 days of account closure |
| Account data | Subscription term plus 90 days | Securely deleted |
| Backups | 30‑day rolling window | Expire automatically |
Ask us to delete everything at any time, or when you close your account, and we'll confirm in writing once it's done.
Subprocessors
A deliberately short list of providers that process your documents or form data, each bound by data‑protection terms. We remain responsible for each of them, and we give 30 days' notice before adding or replacing one.
| Provider | What it does | Assurance |
|---|---|---|
| Microsoft AzureUS · South Central (Texas) | Hosting, file storage, networking and encryption keys | SOC 2 Type II, ISO 27001, HITRUST |
| MongoDB AtlasUS · same Azure region | Database for form data, reached over a private endpoint | SOC 2 Type II, ISO 27001 |
| OpenAIProcessing only · no storage | AI models that fill your forms, under business API terms that prohibit training on your data | SOC 2 Type II |
| AnthropicProcessing only · if your organization uses Claude | AI models, for organizations set up to fill with Claude, under business API terms that prohibit training on your data | SOC 2 Type II, ISO 27001 |
| CloudflareTransit only | Firewall, DDoS protection, HTTPS and DNS | SOC 2 Type II, ISO 27001 |
| Instafill field detectorProcessing only · flat‑to‑fillable conversion | Our own server that finds the fields on a flat PDF's pages when you convert it into a fillable form. Reached through Cloudflare; stores nothing | Operated by Instafill under the controls on this page |
| Hugging FaceProcessing only · fallback | Runs the same field detection when our own detector is unavailable | SOC 2 Type II |
| Adobe · GoogleWord files only | Converting Word documents to or from PDF. If you work only in PDF, they're never involved | SOC 2 Type II, ISO 27001 |
Supporting services that see limited account data only: Stripe (payments), Twilio (two‑factor text messages), SendGrid (account emails) and Amplitude (product‑usage analytics). Files you choose to email to our team pass through Google Workspace, our email provider.
Security documents
The blueprint is public. Everything else is sent on request, most of it the same day.
Security & Compliance Blueprint
8 pages: data flow, providers, controls, AI, testing, incident response, retention and a vendor‑review mapping.
Data Processing Addendum (DPA)Ready to sign
Information Security PolicyOn request
Access, Authentication and SSO PolicyOn request
Data Store Encryption PolicyOn request
Security Incident Management ProgramOn request
Business Continuity PlanOn request
Penetration Testing PolicyOn request
Workstation Security PolicyOn request
Third‑Party Risk Management PolicyOn request
Responsible AI PolicyOn request
Penetration test report (Iterasec, 2025)Under NDA
Completed SIG Lite questionnaireOn request
Provider audit reports (Azure, MongoDB, Cloudflare)On request
Instafill.ai SOC 2 Type II reportIn progress
Request documents
Pick what you need and we'll email it to you, usually the same business day. The penetration test report is shared under an NDA, which we send with it.
The button opens an email in your own mail app, addressed to [email protected]. Nothing is sent until you send it.
Frequently asked questions
Is my data stored outside the US?
No. Documents and form data are stored in Microsoft Azure's South Central US region in Texas. AI providers process each fill over an encrypted connection and don't keep it for training.
Is my data used to train AI?
No. Our contract with you prohibits it, and our AI providers' business API terms exclude your data from model training.
Do you sell or share my data?
No. We use your documents and data only to fill your forms. The providers listed under Subprocessors process it only to provide the service.
Who at Instafill can see my documents?
Only team members who need to, for example someone building your form templates at your request. They work under signed confidentiality agreements, and their access is reviewed every quarter.
Can we delete our data?
Yes, at any time. Your workspace can also delete uploaded sources and completed documents automatically after the number of days you choose. If you close your account, everything is deleted within 30 days and we confirm it in writing.
Do you support multi‑factor authentication?
Yes. MFA is enforced for our own staff, and your organization can require two‑factor sign‑in for every user. Your team can also sign in with Google or Microsoft accounts.
Do you have a SOC 2 report?
Not yet. SOC 2‑aligned controls have operated since October 2025 and the Type II audit is in progress. Meanwhile we share our policies, the penetration test report and the current audit reports of our infrastructure providers.
What happens if there's a breach?
We tell you in writing within 48 hours of becoming aware of it: what happened, which data, roughly how many records, and what we're doing about it.
Can you fill out our security questionnaire?
Yes. Send it to [email protected] and we'll complete it. A completed SIG Lite is also ready to send.