Your team and your agents edit in one shared workspace. Protecting that workspace is core product work, and this page describes how we do it.
Squire Docs lets your team and your coding agents write in the same live document. That rests on three things working together: access is enforced on every request, every edit is attributed and reversible, and the content an agent produces is sanitized before it reaches your document.
Here is how we protect accounts, documents, and the keys you trust us with, as the product works today. To report a security issue, use the contact at the bottom of this page.
How we protect your work
Sign-in and accounts
You sign in with Google, which handles authentication. We store no passwords.
Sessions use signed tokens in httpOnly cookies, marked Secure and SameSite in production, with short-lived access tokens.
Signing out invalidates your existing sessions server-side.
Access control
Every document has owner, editor, and viewer roles, and access is checked on every API request, live editing connection, and agent action.
Each role grants exactly what it should: viewers read, editors change content, owners manage sharing. Search returns only documents already shared with you.
Access is re-checked continuously during a live session, so revoking someone takes effect immediately.
Agents act with your permissions
An agent acts with your permissions, on the documents you can already reach.
Every agent edit is attributed by name in version history and is fully reversible.
Agent access tokens are scoped to specific permissions, expire, can be revoked at any time, and are stored as hashes.
The scripts agents run to edit a document execute in an isolated sandbox that can reach only the document being edited.
Encryption
All traffic is served over HTTPS with modern TLS (1.2+) and HSTS.
Data at rest lives on encrypted disk volumes, and database backups are encrypted too.
If you bring your own AI provider key, we encrypt it with AES-256-GCM before storage and use it only server-side to call your provider.
Untrusted content
AI and agent output is sanitized before it's rendered. Diagrams and images an agent produces are stripped of scripts and external references.
Links are restricted to safe protocols, and images must point at our own storage.
When an agent fetches a web page, we block requests to internal and cloud-metadata addresses to prevent server-side request forgery.
Infrastructure
The application runs behind a CDN and a web application firewall; the origin servers are reachable only from the CDN's network ranges, and administrative ports are locked to us.
Cloud credentials are hardened against theft, and every internal component is granted only the access it needs.
Encrypted backups run nightly with versioning and retention locking, and we run graceful shutdowns so your in-flight edits are saved on every deploy.
Reporting a vulnerability
Found a security issue? Email security@squiredocs.com with steps to reproduce and the impact. We aim to acknowledge reports within a few business days and will keep you posted as we work through a fix. We welcome good-faith research and give researchers who follow responsible disclosure room to work.