Built to hold your most sensitive documents
Your clients trust you with private information. We take that seriously. CoyaDocs is secure by default, private by principle, stored in Canada, and always under your control.
- Data stored in Canada
- AES-256 at rest
- TLS 1.2+ in transit
- PIPEDA-aligned
- Never used to train AI
Encrypted in transit & at rest
Every upload travels over TLS and is stored with AES-256 encryption. Nothing sensitive ever sits in the clear.
Hosted in Canada
CoyaDocs runs on AWS Canada (Central) in Montreal. Your documents are stored in Canada and never leave it.
Strict access control
Documents are visible only to you and the team members you explicitly invite. Least privilege by default.
Scoped, expiring links
Client upload links are tied to a single request, time limited, and can be revoked the moment you need to.
Private by principle
We never sell your data and never use your clients' documents to train AI models. Your files are yours.
You control retention
Keep documents as long as you need, then archive or delete them. Nothing is removed without your say-so.
Clear rules, applied every time
No surprises and no fine-print gotchas. Here's exactly how your clients' documents are treated from the second they're uploaded.
- Files are encrypted the moment they're received, before they're written to storage.
- Everything is stored in Canada, on AWS Canada (Central) in Montreal.
- Each customer's data is logically isolated; one account can never see another's.
- Upload links are unguessable, single-purpose and expire automatically.
- Access to documents requires authentication and is limited to invited team members.
- Personal information is handled in line with PIPEDA, Canada's federal privacy law.
- You can export or permanently delete your data at any time.
Access lasts minutes, not forever
Nothing in CoyaDocs hands out standing access to a file. Every read and every write is authorised for one short, specific window.
- Upload authorisation
- 15 minutes
- Each file gets its own signed upload window, issued the moment your client picks the file.
- Download authorisation
- 5 minutes
- Every link that opens a stored document is signed for one short window, then stops working.
- Client portal session
- 7 days
- How long a client stays signed in to their portal after opening the link you sent.
- Abandoned uploads
- Cleaned up
- Uploads that start but never finish are removed on a schedule, file and database record together.
Everyone who touches your data
The complete list, not a selection. If a company is not on it, it has no access to anything of yours.
Amazon Web Services
Hosting, file storage and the database.
- Data it handles
- The files your clients upload, their metadata, and your account records.
- Processed in
- Canada. Montreal, ca-central-1.
Resend
Every email CoyaDocs sends: reminders to your clients, and account notices to you.
- Data it handles
- Names and email addresses for you and your clients, and the names of the items you requested. Never the contents of a file.
- Processed in
- United States.
Paddle
Payments and subscription billing, acting as merchant of record.
- Data it handles
- Your billing contact and invoice details. Nothing about your clients.
- Processed in
- United Kingdom and United States.
Only AWS, in Canada, ever holds an uploaded file. The email and billing providers above never receive file contents.
Your security questions, answered
Do my clients need an account to upload securely?
No. They use a secure, single-purpose link. It's frictionless for them and still encrypted end to end. The link is scoped to one request and expires.
Where is my data stored?
In Canada. Documents live in AWS Canada (Central) in Montreal and never leave Canadian infrastructure. When a client or regulator asks where their information sits, you have a one-word answer.
Who can see the documents my clients upload?
Only you and the team members you invite. Access is authenticated and follows least-privilege principles. No one at CoyaDocs browses your files.
Do you use my data to train AI models?
Never. Your documents are not sold, shared or used to train any model. They exist to do one job: be collected and stored securely for you.
What happens to files if I cancel?
You stay in control. Export everything before you go, and request permanent deletion of your data whenever you choose.
Is CoyaDocs suitable for sensitive or regulated information?
CoyaDocs is built with privacy-sensitive professions in mind: accountants, lawyers and immigration consultants. Files are protected with AES-256 encryption and strict access controls, all data stays in Canada, and personal information is handled in line with PIPEDA. If you have specific regulatory requirements, get in touch and we'll walk through the details.
Found a vulnerability?
Tell us at security@coyadocs.com and we will confirm we have it. Please give us a fair window to ship a fix before you publish, and while you are testing, stay out of data that is not yours. Research done on those terms is welcome here, and we will not come after you for it.
Machine-readable contact: /.well-known/security.txt (RFC 9116).
Security shouldn't be the hard part
Join the waitlist and be among the first to collect documents the safe, effortless way.