Security Center
Private document storage
Uploaded documents are stored in a private Cloudflare R2 bucket. Deadline Shield does not issue permanent public document URLs. File download, analysis, retention changes, and deletion are handled through authenticated application routes that verify the document belongs to the signed-in workspace.
Encrypted connections
Deadline Shield is served over HTTPS. Security headers shipped with the application include HTTP Strict Transport Security, a Content Security Policy, clickjacking protection, content-type sniffing protection, restrictive referrer handling, and private/no-store caching on API responses.
Account protection
- New and updated passwords use scrypt-based password hashing. Older PBKDF2 password records are migrated after successful authentication rather than storing plaintext passwords.
- Session cookies are HttpOnly, Secure, SameSite-protected, and server-validated.
- Optional authenticator-app two-step verification is available. The TOTP secret is encrypted with AES-GCM using a Cloudflare Worker secret rather than stored readable in D1, and recovery codes are stored only as one-way hashes.
- Authentication endpoints are rate-limited to reduce brute-force abuse.
- Password resets invalidate existing sessions.
- Users can end other active sessions from Security & Privacy settings.
- Permanent account deletion requires the account password again. Users with a subscription are told to cancel that plan in Billing & receipts first.
Upload protections
Deadline Shield accepts a limited set of document formats and validates the file's declared format against its contents. Large documents are uploaded in parts with an overall 100 MB application limit, reducing the need to send sensitive documents to third-party PDF-compression websites.
The no-account free scan uses the same private R2 storage and file-signature checks with a high-entropy scan token rather than a public document URL. Free scans are rate-limited, analyze only a bounded preview, and automatically expire unless the user claims the original into an authenticated workspace.
Privacy inventory and deletion controls
The Security & Privacy area can show how many original files remain stored, how many are scheduled for deletion, how many AI analysis jobs and pending findings remain, and how many saved source-evidence records are attached to reminders.
Bulk deletion of originals and deletion of AI analysis history/source evidence require password re-verification. Users can remove AI analysis history and source evidence while keeping the reminder titles, dates, notes, and notifications they already approved.
Document retention and deletion
New uploads default to a 30-day original-file retention period. Users can instead choose deletion after analysis, 7 days, 1 year, or keep the original until manually deleted. Users can also delete an original immediately or purge all stored originals while retaining already-approved deadline information, the saved source snippet attached to those reminders, and the reminder history.
When an original is deleted through Deadline Shield, the corresponding object is removed from Deadline Shield's R2 document storage. Account deletion removes stored originals before the account and sole-member workspace are removed.
Large-document processing
Large documents are analyzed in bounded sections rather than being pushed into one oversized AI prompt. Analysis progress is saved after each section so an interrupted review can resume. Temporary section text is cleared as each section finishes, and the remaining temporary analysis job data expires automatically.
Deadline Shield can collect multiple findings from one document, removes likely duplicates across overlapping sections, and requires the user to approve findings individually before reminders are created.
Evidence and ambiguity handling
Deadline Shield is designed not to silently convert ambiguous relative language into a calendar date. If a phrase such as “within 30 days of receipt” depends on information the document does not contain, the finding is marked as needing user input and the calendar date is left blank until the user supplies or verifies it.
When a finding becomes a saved reminder, Deadline Shield can preserve the supporting document name, excerpt, section or page when available, finding type, confidence, and explanation so the user can trace the reminder back to its source.
Users can also open a printable Document Brief containing document findings and source evidence. The brief is an organizational summary only and is specifically labeled as not providing legal, tax, financial, insurance, medical, regulatory, or other professional advice.
AI document analysis
Document analysis runs through Cloudflare Workers AI. The AI is instructed to extract information stated in the document rather than provide legal conclusions. Findings include supporting evidence when available, and Deadline Shield verifies that a quoted supporting excerpt actually appears in the converted document text before presenting it as evidence.
Candidate findings also receive an independent second AI check against the same source section. That verifier is not allowed to invent or substitute a calendar date; if it cannot support the first-pass date, Deadline Shield removes the proposed date and requires human review instead.
AI findings are suggestions. A user must review and approve the date before Deadline Shield saves it as a reminder.
What we deliberately do not claim
Deadline Shield does not claim to be unhackable, zero-knowledge, or end-to-end encrypted. The service must be able to read a document in order to analyze it. We would rather describe the controls we actually use than make a security claim the architecture does not support.
Billing safety
If you have a subscription, cancel it first in My Account → Billing & receipts before deleting your entire account. Deleting the account is not a substitute for canceling your plan. If a sole-member workspace with an active Deadline Shield subscription is then permanently deleted, the application also attempts to cancel that subscription. If billing cannot be safely canceled, account deletion stops instead of removing access while billing could continue.
Security regression checks
Production builds include automated checks for core security controls such as secure session cookies, login rate limits, document ownership scoping, private download caching, upload validation, retention controls, password hardening, AI evidence grounding, and security headers.
Security issues
If you believe you found a security problem, please do not post sensitive details publicly. Contact us directly so we can investigate.