Trust
Security at Punctilio
Punctilio is built for sensitive client requests, data rooms, and agreements. This overview explains the protections customers can rely on, along with the important limits.
The controls described here are included in every workspace. We do not reserve core security features for a higher-priced plan.
Access and sharing controls
Workspace access is isolated. Member authentication is provided by Supabase Auth, and database and storage policies keep each organization’s rooms, files, signing records, and activity separate.
Share-link rules are enforced on the server. A link can require verified email, an allowlist or denylist, a password, NDA acceptance, and an expiration date. Links can be limited to selected content, have downloads disabled, and be revoked at any time. Tightening a link forces existing viewers back through its access checks.
Activity is recorded. Opens, file and page views, downloads, dwell time, and security events are written through protected server paths rather than directly by a viewer’s browser.
Document protection
Encryption in transit and at rest. Punctilio uses HTTPS throughout. Managed database and storage encryption is provided by our infrastructure providers.
Client-side encryption for supported files. Supported files added directly to new rooms are encrypted in the browser before upload. The key carried in a recipient’s link stays in the URL fragment and is not sent in normal HTTP request paths. Video and unsupported formats use protected managed storage. This is client-side encryption for the stated file path, not a zero-knowledge claim.
Watermarking and download controls. Optional viewer-identifying watermarks appear across supported previews, and download restrictions are enforced by the file-serving service. If downloads are enabled, the downloaded file is the original rather than a watermarked copy.
Client upload safety
Files submitted by outside visitors through a collect link are quarantined and malware-scanned before they can be approved or filed into a room. The process fails closed if scanning is unavailable. Files uploaded directly by authenticated workspace members do not use this scanning path.
Signing and audit evidence
Signing links expire and can be protected with signer-specific access codes. Each signing ceremony records who acted, when, and from which browser and network address, and produces downloadable audit evidence with stored integrity hashes.
Completed agreements are sealed as flattened PDFs and completed values are locked against later editing. The audit trail establishes the chain of custody; the sealed PDF does not contain a certificate-based cryptographic digital signature.
Application and recovery
Punctilio uses restrictive browser security headers, bot detection, rate limits on sensitive public actions, signed webhook verification, and server-side authorization for privileged operations. Production and preview use separate data projects.
Encrypted disaster-recovery copies are kept in private storage, are unavailable through the product, and are retained for no more than 30 days. Access to production systems and recovery automation is limited to the credentials required for each service.
Limits worth understanding
No web application can prevent someone from photographing or capturing a screen at the operating-system level. Punctilio’s screenshot and print controls are deterrence and event tracking, not a guarantee of prevention. Bearer links should also be treated as sensitive credentials even when additional access gates are enabled.
Report a security concern
If you believe you have found a vulnerability, please report it privately to support@punctil.io. Please do not include customer data, secrets, or live access links unless we ask for them through a secure channel.
Subprocessors
Punctilio uses a small set of providers to operate the service:
| Subprocessor | Purpose |
|---|---|
| Vercel | Application hosting, bot detection, and web analytics |
| Supabase | Authentication, database, file storage, and server functions |
| Stripe | Billing and payments |
| Resend | Transactional email |
| AgentMail | Inbound support and general inquiries |
| Railway | Private malware scanning and document conversion |
| Sentry | Error monitoring with session replay and performance tracing disabled |
| GitHub | Source control and encrypted recovery automation |
| Cloudflare | Bot-challenge verification and encrypted disaster-recovery storage |
Optional advertising measurement. OpenAI is an advertising measurement recipient, not a provider used to operate customer documents. With Advertising measurement consent, it can receive only the click reference and limited server-side trial event described on our cookies and measurement page.
Punctilio is built by PumpKin Baby Inc. Questions about these controls are welcome at support@punctil.io.