Security
How Planet OCR protects accounts, uploads, and API access.
- Built to run on HTTPS in production.
- Passwords and API keys are stored hashed.
- You can review logins and end sessions in the Dashboard.
- No SOC 2, ISO 27001, or HIPAA badges.
Overview
Planet OCR handles documents that can contain sensitive information. This page describes controls that exist in the product today. It is not a certification.
In transit
The product is built to run on HTTPS in production. Document files are served only through authenticated API routes — not a public storage path.
Passwords, keys, and sessions
Passwords are stored with bcrypt. Dashboard sessions use JWTs in HttpOnly cookies.
API keys start with ocr_, are hashed, shown once, scoped, and revocable from the Dashboard.
Access is role-based (user or super admin).
What we log
For security we record IP address, approximate location, browser, login success or failure, and session activity. You can review this under Dashboard → Security and end a session there.
Repeated failed logins and mass registration from one network are throttled.
Uploads and jobs
Uploads must be PDF or image (PNG, JPG, WEBP). Size is limited, and file type is checked against the file contents.
New jobs are blocked when plan quota is exhausted or the wallet cannot cover the request.
You can cancel a running job. Deleting a job from History also removes stored results.
OCR
OCR runs on Planet OCR infrastructure. Ordinary Advisor and API messages do not expose internal engine vendor names.
What we do not claim
We do not display SOC 2, ISO 27001, HIPAA, or similar badges.
Enterprise
Enterprise customers can request a security questionnaire and a Data Processing Agreement. Start with sales@planetocr.com, or see the DPA page.
Report a vulnerability
Email security@planetocr.com. Do not include unnecessary personal data.