Retempla — Document Transformation

Retempla — Security Overview

Retempla rebuilds your Word documents into your company template without ever changing the words inside them. Because we handle your documents, we take the security and privacy of that data seriously. This page explains, in plain language, the controls we have in place. It is written to be reused on our public website's security page.

Last reviewed: before production launch.

Your documents

We never alter your text. Conversion changes only formatting, styling, numbering, tables, images, and template labels — never the body text of your document. This is enforced in code by an automated word-for-word comparison on every conversion: if a single word would be added, removed, or changed, the conversion is rejected rather than delivered. It is the core promise of the product.

Your files are isolated from every other customer. Every stored file lives in a private, per-customer area. Each time a file is read, the system verifies that it belongs to the customer requesting it, at two independent layers (the database record and the storage key). One customer can never see, guess, or download another customer's documents.

Files are stored on Cloudflare R2, a reputable object-storage service, using credentials that are scoped to our storage bucket only — even in the unlikely event a key were exposed, it could not reach anything else in our account.

Download links are temporary. When you download a converted document, the link is individually signed and expires within minutes. Old links stop working automatically.

We don't keep your files forever. Uploaded and converted documents are automatically deleted after 30 days by a scheduled daily task. Every such deletion is written to our audit log. You can also delete your account at any time, which removes all of your stored files and data immediately.

Accounts and sign-in

No passwords. Retempla has no passwords to steal, reuse, or leak. You sign in with a "magic link" emailed to you:

  • Each link works once and expires after 15 minutes.
  • We never store the link itself — only a one-way cryptographic hash of it — so even our own database cannot reveal a working link.
  • Sign-in requests are rate-limited per email address and per network address, which blunts automated abuse.

Sessions are protected. Once you're signed in, your session is held in a cookie that is:

  • HttpOnly — not readable by any JavaScript, so it can't be stolen by a malicious script;
  • Secure — only ever sent over encrypted HTTPS connections;
  • SameSite — not sent on requests originating from other websites.

Sessions are long random values that cannot be guessed, and they expire after a set period.

Protecting against common web attacks

  • Encryption in transit (HTTPS). All traffic is served over HTTPS. We instruct browsers (via HSTS) to only ever connect to us securely.
  • Cross-site request forgery (CSRF). State-changing actions are protected by two layers: same-site cookies (above) and a server-side check that the request genuinely originated from our own site. Requests forged by another website are refused.
  • Clickjacking. Browsers are told never to embed Retempla inside another site's frame.
  • Content Security Policy. The browser is instructed to load scripts, styles, and images from our own site only, which sharply limits the impact of any content-injection attempt.
  • MIME sniffing and referrer leakage are disabled/limited via standard security headers on every response.

Safe file handling

Every uploaded file is validated on our servers, on the raw bytes, before anything is stored — browser hints are never trusted. We reject:

  • files that aren't genuine Word .docx documents;
  • legacy .doc files (we ask you to re-save as .docx);
  • files larger than our size limit, and batches over our file-count limit;
  • password-protected / encrypted documents;
  • "zip bombs" — files crafted to expand to an enormous size — which are detected and refused before extraction;
  • documents with unresolved tracked changes, because accepting them could silently misrepresent your text (this protects our "we never alter your text" promise).

Each document is converted in an isolated, short-lived process with a hard time limit, so a single problematic file cannot affect other customers' conversions or tie up the system.

Infrastructure and operations

  • Least privilege. The application runs as a non-root user inside its container, and its storage credentials are scoped to a single bucket.
  • Secrets management. All secrets (API keys, database credentials, the cookie-signing key) are supplied through environment variables, read in a single place, never written to logs (they are masked), and never stored in our source code repository.
  • Audit logging. Security- and data-relevant actions — sign-in requests, sign-ins, uploads, conversions, downloads, deletions, and account deletion — are recorded in an append-only audit log with a timestamp and originating network address.
  • Error monitoring. Unexpected errors are reported to our monitoring service (Sentry) so we can respond quickly. Reports are configured not to include request bodies, cookies, or personal data.
  • Pinned dependencies. Every third-party software component is locked to a specific, reviewed version, so the software we test is exactly the software we run. Updates are deliberate, not automatic.
  • Backups. The database is backed up on a daily schedule, with a tested restore procedure.
  • Health monitoring. A health endpoint continuously verifies that the database and file storage are reachable; an external monitor alerts us if the service is degraded.

Data we process

  • Account data: your email address (used only to sign you in and contact you about the service).
  • Your documents: the files you upload and the converted results, retained for up to 30 days and then deleted automatically.
  • Operational records: the audit log described above.

We do not sell your data. We do not use your document contents for any purpose other than performing the conversion you requested.

Artificial intelligence

Retempla can optionally use AI to improve metadata extraction and typographic polish. AI is never required: with AI disabled the product still converts every document correctly using built-in rules. When AI is used, it is applied only to a restricted, pre-approved set of formatting actions, and every AI-suggested change is re-checked against our "text is never altered" guarantee and discarded if it would change your words.

Reporting a vulnerability

If you believe you've found a security issue, please contact us at security@retempla.com (replace with your real address before publishing). We welcome responsible disclosure and will respond promptly. Please do not publicly disclose an issue until we've had a reasonable chance to address it.