Security
How we protect your data, in plain English.
What we encrypt
- Your SEVIS ID (AES-256-GCM, application layer)
- Your passport number (AES-256-GCM, application layer)
- Your date of birth (AES-256-GCM, application layer)
- All documents at rest (server-side encryption on our storage provider)
What we never do
- Sell your data
- Use your documents for advertising
- Share your documents with third parties
- Train AI models on your data
- Retain your data after you delete it
What happens to your documents
Uploaded files go straight to a private Cloudflare R2 bucket. They are never publicly accessible. Download links are presigned URLs that expire after 2 minutes. When you delete a document, the underlying file is removed from storage.
Third parties
We use a small, named set of vendors, and only for what's listed:
- Cloudflare R2, file storage
- Resend, email delivery
- Railway, application hosting
- Groq, AI advisor responses (text only, your documents are never sent)
Delete your data
Go to Settings, scroll to Danger zone, and confirm account deletion. This permanently removes your profile, documents, and encrypted fields from our servers.
Contact
Security questions or reports: security@waypointai.app