How Usual protects your clients' documents

At a glance

• Every file is encrypted under its own key, derived from a key unique to your firm. Our storage provider cannot read a file without it, and no file key is ever written down.
• SSNs, EINs and bank account numbers are encrypted again with AES-256-GCM, shown as the last four digits, and revealed in full only to people you allow, after two-step verification, with a record of each view.
• Each firm is kept apart in the database itself, not only in the app: every query runs under row-level security for one firm.
• Every upload is virus-scanned before anyone at your firm can open it. If a scan fails, the file stays locked.
• Documents never travel by email. Clients get a link; files stay in Usual.
• Encrypted in transit with HTTPS everywhere and HSTS, and at rest for files, the database and backups.
• Two-step verification for your team, which you can require for everyone, plus a check against known breached passwords.
• Five roles, and staff who can be limited to only the clients assigned to them.
• An activity record that cannot be edited or deleted, enforced by the database.
• Data stored in the United States. Daily backups kept for 8 weeks.

Every file has its own key

When a client uploads a document, Usual stores it encrypted with a 256-bit key made for that one file. The key is derived from your firm's own data key (with HKDF-SHA256) at the moment the file is read or written, and it is never stored. Our storage provider (Cloudflare R2) encrypts the file with that key and refuses to return it without the same key: a request with no key, or with another firm's key, is turned away.

Your firm's data key is itself stored only in encrypted form, wrapped by a master key that lives in our hosting provider's secret store, outside the database. So a copy of the database alone, or of the storage bucket alone, does not reveal a single document.

Large files are encrypted the same way, part by part, up to 1 GB. Previews, downloads, ZIP downloads, exports and the copy to your own Google Drive or OneDrive all read the file with its key; nothing keeps a decrypted copy.

SSNs, EINs and bank account numbers

Social Security numbers, ITINs, EINs and bank account numbers are a second layer up. Usual encrypts each value with AES-256-GCM using your firm's data key before it reaches the database, and keeps only the last four digits in readable form for lists.

• Everyone sees the last four digits (for example •••• 6789).
• Seeing the whole number needs a role your firm allows to do it and a fresh two-step verification code.
• Every full view is written to the activity record: who, which client, when.
• Full numbers are never put in emails, text messages, URLs, logs or analytics.

Client notes, the tokens behind client links and team invitations, and the sign-in for your connected Google Drive or OneDrive are encrypted the same way.

Each firm kept apart

Many products separate customers only in their application code. Usual also separates them in the database: every table that holds client data has a row-level security policy, and every request runs as a restricted database user that can see only the rows of one firm at a time. A mistake in a screen or a report cannot show one firm's clients to another, because the database itself will not return them.

Who can see what

• Owner: everything, including closing the account.
• Admin: settings, team, billing, the connected drive and full exports.
• Staff: sends requests and works with clients.
• Reviewer: reviews and accepts what clients send.
• Viewer: read-only, and can never see full account numbers.

Any staff member can also be limited to their assigned clients. They then cannot see other clients or anything about them, again enforced by the database rather than by hiding buttons.

Signing in

• Two-step verification with an authenticator app, with backup codes. A firm can require it for everyone on the team, including people who sign in with Google or Microsoft.
• Passwords of at least 12 characters, checked against known breached passwords (Have I Been Pwned) without sending the password itself.
• New email addresses are confirmed with a code before the account works.
• Sign in with Google or Microsoft if you prefer.
• Settings → Security lists every signed-in device, and you can sign them out. Resetting a password signs out every device.
• Repeated failed attempts are rate-limited.

Your clients' links

Clients don't need an account or a password, which is why they finish. That makes the link itself important, so Usual treats it like a key:

• Each link carries a 256-bit random token. Only a hash of it is stored, so a database copy cannot be used to open anyone's checklist.
• By default a client confirms their email with a six-digit code before they see anything, and then stays signed in on that device. Codes expire after 10 minutes and allow five tries.
• Links stop working when the request is closed, and when the firm closes its account.
• Every client link is rate-limited by network address, with a much tighter limit on codes.

Every upload is virus-scanned

Every file a client or staff member uploads is scanned with ClamAV, with its virus definitions kept up to date, before anyone at your firm can open it. An infected file is deleted. If a scan can't run, the file stays locked until it can: Usual fails closed, never open.

Nothing sensitive in email

Usual's emails and reminders never carry attachments, documents or full account numbers. They carry a link back to Usual. Staff download large files through a signed link that works for two minutes.

A record of every view

Usual keeps an activity record of what happens to your clients' information: uploads, downloads, full-number views, exports, signatures, team and settings changes. The record can only be added to: the database user the app runs as is not allowed to change or delete it.

Where data lives, and backups

• Files and the database are stored in the United States (Cloudflare R2 and Neon Postgres). Support chat, if you use it, is the one exception; see the Privacy Policy.
• The database is backed up every day by a read-only account into a private, encrypted bucket, kept for 8 weeks, with an alert if a backup is missed. It can also be restored to any point in the last 24 hours.
• Everything runs on managed infrastructure with HTTPS-only connections; there are no servers of ours to patch or lose.

When you leave

An owner can close the account at any time. Client links stop at once and nothing else is sent. You have 30 days to download everything; after that Usual deletes your firm's files from storage and its records from the database. Because every file is encrypted under keys derived from your firm's data key, deleting that key leaves any remaining copy unreadable. Files you empty from the recycle bin are deleted from storage too, not only hidden.

How this compares

Content Snare, a widely used client portal, says it is ISO 27001 certified, encrypts data in transit and at rest with unique encryption keys per company, uses role-based access controls, hosts on AWS and keeps sensitive documents out of email (from its homepage, checked November 9, 2026). Here is the same list for Usual:

See also Usual vs Content Snare.

Certifications

Usual does not have an ISO 27001 certificate or a SOC 2 report yet. Those are paid audits, and we would rather show you the controls themselves than a logo. We will start a SOC 2 audit as the customer base grows. Until then, we answer security questionnaires (including the FTC Safeguards Rule questions your own compliance program asks about vendors) in writing: email support@usual.so.

Questions and reports

If you think you've found a security problem in Usual, email support@usual.so with "Security" in the subject. We read every report, reply within two business days, and won't take action against good-faith research that avoids other people's data. If we learn of an incident affecting your clients' information, we notify you without undue delay, as the Privacy Policy says.