Built to protect the things that matter.
How Handled is designed to keep your documents safe. This describes how it's built and the commitments we hold ourselves to.
Handled holds the paperwork you'd least like exposed. Legal, financial, personal. So security isn't a feature; it's the point. Our approach is defense-in-depth: Base44's certified platform underneath, and least-privilege design on top.
Built on Base44
Handled runs on Base44, a fully managed application platform. That means Handled is built on SOC 2 Type II-audited and ISO 27001-certified infrastructure, with:
- Encryption in transit and at rest, using industry-standard encryption.
- Continuous monitoring, automatic patching, and managed backups.
- Secure, threat-detected APIs and platform-level vulnerability scanning.
These certifications are Base44's, describing the infrastructure Handled is built on.
Your data stays yours
- Handled files your documents into your own cloud: Google Drive, Dropbox, or OneDrive, inside a single "Handled" folder we add to but never reach beyond.
- We keep only metadata, a secure hash (SHA-256), and timestamps on our side. Never your files.
- Handled never sells your data.
- No bank linking and no stored email passwords. You forward or scan only what you choose.
Access and accounts
- Row-level security: your records are reachable by your account alone.
- Sign in with Google, Microsoft, Facebook, or Apple, or with your email and password.
- Data minimization: we collect only what's needed.
- One-tap export and delete, whenever you want them.
What we don't claim
- Handled surfaces your own documents. It does not give medical, legal, or financial advice.
- We keep tamper-evident, time-stamped records. We don't claim they are "court-admissible."
- Handled does not claim HIPAA compliance.
Reporting a vulnerability
Security researchers are welcome. If you believe you've found a vulnerability, please report it through our contact form and choose "Security report." See also our security.txt. We commit to responsible-disclosure handling.
Accessibility
Handled is built to meet WCAG 2.2 AA: readable contrast, clear structure, keyboard support, and respect for reduced-motion. If something isn't working for you, tell us via the contact form.
Security is a shared responsibility and no system is perfectly secure, but Handled is designed to hold as little as possible and to check every request against your account. This page describes our security approach and commitments; it is general information, not legal advice.