Misfora notifies affected clients no later than 24 hours after becoming aware of a security incident affecting their data. Because document images and recognized data are not stored, a compromise of Misfora's database, backups or logs cannot expose them.
1. Scope
A security incident is any event that compromises, or is reasonably likely to compromise, the confidentiality, integrity or availability of data processed through the Web Scanner SDK or the OCR API — for example unauthorized access to infrastructure, a leaked API key or token, a vulnerability in a component that processes uploaded images, or a prolonged outage.
2. Detection
| Source | What it detects | Frequency |
|---|---|---|
| Hosting platform (Railway) alerts | Crashes, failed deployments | Real time, email |
| External uptime monitoring | API and SDK endpoints unavailable | Every 5 minutes |
| Automated request-log checks | Spikes in invalid credentials, requests from unregistered websites, rate-limit rejections, recognition errors, malformed uploads | Hourly, email to the administrator |
| Dependency audits and GitHub Dependabot | Newly disclosed vulnerabilities in dependencies | On every change and weekly |
| Service statistics review | Unusual usage or error patterns | Daily |
| External reports | Issues reported by clients or researchers | security@misfora.com, see /.well-known/security.txt |
3. Response steps
- Contain. Stop the incident from spreading — for example revoke or reissue affected API keys, invalidate SDK sessions, block traffic, roll back a deployment or disable an affected feature.
- Assess. Establish what happened, when, and which clients and requests are affected, using the API request log (time, client, request ID and SDK session for every request) and hosting-platform logs.
- Notify. Inform affected clients as set out in section 4.
- Remediate. Fix the cause, deploy the fix and confirm it works.
- Review. Record the incident, its impact, the timeline and the measures taken to prevent recurrence in the incident log.
4. Client notification
- When: without undue delay and no later than 24 hours after Misfora becomes aware that an incident affects, or is reasonably likely to affect, the client's data.
- How: by email to the client's registered contact address.
- What: as far as known at the time — what happened and when; the categories of data and the requests likely affected; the measures taken; recommended actions for the client (for example reissuing API keys); a contact for questions. Information not yet available is provided in phases as the investigation progresses.
- Support: Misfora assists clients in meeting their own obligations to notify supervisory authorities and data subjects.
5. Potential impact by data type
| Data | Exposure if Misfora's infrastructure were compromised |
|---|---|
| Document images, recognized document data | Not stored; not exposed through the database, backups or logs. Only requests being processed at the moment of compromise could be affected |
| Request metadata | Could be exposed (time, client, request and session identifiers, document type, technical details) |
| API keys | Stored as Argon2id hashes; keys cannot be recovered from the database |
| SDK session tokens | Stored as SHA-256 hashes; tokens expire within 15 minutes |
| Client IP addresses | Held in hosting-platform logs for up to 90 days |
6. Roles and continuity
The Misfora administrator is responsible for incident response. If the administrator is unavailable, a designated trusted person can obtain access credentials through an emergency-access procedure to maintain the service. The procedure is tested at least once a year; every use is recorded in the incident log, and the affected credentials are changed afterwards.
7. Review
This policy is reviewed at least once a year and after every significant incident.
A Data Processing Agreement for the Web Scanner SDK and OCR API is available on request: partners@misfora.com. Report security issues to security@misfora.com. See also the Privacy Policy.