Executive Security Summary
drive.file scope technically prevents DocTick from accessing any existing files or folders in your Google Drive.1. Google OAuth 2.0 & Restricted Scope Isolation
How Google technically isolates your existing Drive from DocTick.
When software integrates with Google Drive, Google offers several levels of permissions. Many tools take the easy way out and request full Drive access (https://www.googleapis.com/auth/drive), which allows the app to read all files in your cloud storage.
DocTick takes the privacy-first approach and requests strictly the per-file sandbox scope:
Under Google's OAuth 2.0 protocol, the drive.file scope guarantees that:
Only the /DocTick folder and client subfolders created specifically by DocTick on your behalf.
DocTick has zero visibility into your personal files, spreadsheets, tax software backups, or folders created outside DocTick.
2. Zero-Storage Pass-Through Upload Protocol
Why your clients' sensitive documents never sit on DocTick servers.
Traditional client portals store your clients' tax returns, W-2s, and bank statements in their own centralized cloud databases. If that vendor is breached or goes out of business, your clients' most confidential records are exposed.
DocTick eliminates this liability with a direct pass-through architecture:
/DocTick/Clients/[Client Name]/[Request Title]/, ready for your tax or legal software to import.3. Real-Time AI Verification & Limited Use Compliance
How document analysis works safely without storing or training on client paperwork.
DocTick Pro provides real-time document verification to detect wrong tax years, mismatched names, or cropped documents before they land on your desk. Here is our binding data commitment:
- Ephemeral In-Memory Processing: Text extraction for document verification runs ephemerally in RAM strictly to determine document type and tax year. Extracted text is never stored or archived on DocTick servers.
- Zero AI Model Training: In accordance with Google's Limited Use requirements, user data and client paperwork are never used to train, fine-tune, or improve generalized Artificial Intelligence (AI) or Machine Learning (ML) models.
- No Human Snooping: DocTick personnel never manually inspect your clients' uploaded documents or extracted text.
- Strict Limited Use Compliance: DocTick's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Client Portal & Magic Link Sandbox
How client upload portals prevent accidental data leaks or unauthorized browsing.
Each request generates a unique, unguessable high-entropy magic token (e.g. /r/sarah-jenkins-8k2f). Only individuals possessing the exact URL can access the checklist.
All internal Google Drive folder IDs, file IDs, and web URLs are stripped from the response sent to the client browser. Clients can never browse your Google Drive directory.
Advisors can close or archive any request with a single click. Once closed, the magic link becomes read-only and no further uploads are accepted.
Checklist metadata is encrypted at rest using AES-256 in Cloud Firestore. All data in transit uses modern TLS 1.3 encryption.
You remain in total control — disconnect anytime in 1 click
Because DocTick uses official Google OAuth 2.0, you never share your Google password with us. You can audit or revoke DocTick's permissions at any time:
When disconnected, all folders and files your clients have uploaded remain intact and safely preserved in your Google Drive.
Questions from your firm's compliance officer?
Our engineering and security team is available to answer custom SOC 2, HIPAA, or ISO 27001 intake questionnaires.