Dress Docs, in writing, for your approval
For data protection officers, IT security and procurement. It states what stays on the device, what reaches us, and what we assessed ourselves. Last reviewed: October 18, 2026.
At a glance
- Documents stay on the device
- Opening, redacting and exporting happen in the browser or app. No document, page or excerpt is uploaded.
- Covered content is removed
- Each exported page is one image; text, layers and objects under a cover are not in the file.
- Metadata is removed
- Author, title, producer, dates and the PDF fingerprint are cleared on every export.
- Served from Germany
- The site and web app are served from Hetzner in Falkenstein, Germany.
- Telemetry without document content
- Cookieless page analytics on our own server in Germany, and error reports with technical details only, never document content, from the site and web app to Sentry in the United States.
- Self-assessed, not certified
- We assessed Dress Docs against ISO/IEC 27038 ourselves. It holds no certification.
Data flow
Stays on the device
The documents you open, everything you add to them (covers, reasons, text, signatures, watermarks), the exported files, saved work and the redaction log.
Reaches us or a named service
- Page visits — counted without cookies on our own analytics server in Germany. No personal data.
- Server logs — the web servers of the site and the web app log each request, with details such as IP address, time, page, referrer and browser. On the site, requests for static files (images, scripts, styles) aren't logged.
- Error reports — from the site, web app and phone app, sent to Sentry in the United States: technical details such as the error, browser, device type and IP address. Never document content.
- Account (paid plans only) — e-mail and plan, held in the United States by the controller, Vzlaio digital LLC. Never documents.
- Payments (paid plans) — payment details, taken by Stripe at checkout.
- Each service is listed below, under Telemetry, stated plainly.
Never reaches us
Any document, page, image or excerpt; anything typed into a document; the redaction log; the passphrase for saved work.
1Where it runs
The site and the web app are served from Hetzner in Falkenstein, Germany. Their server logs are kept on those servers. Our page analytics server runs at Hetzner in Falkenstein, Germany, too. The account backend for paid plans runs on Heroku in the United States. Error reports from the site, web app and phone app go to Sentry in the United States. Payments run on Stripe.
2We don't process your documents
Documents are processed only on your device, by software running there. We never receive them, so we process no document content on your behalf. For account data (e-mail and plan) on Pro, Team and Organization, the controller is Vzlaio digital LLC (USA); see the app privacy policy. Stripe is the merchant of record for payments: it takes the payment, handles VAT and issues the invoice. This is our reading of the GDPR roles, not legal advice; your data protection officer decides.
3Telemetry, stated plainly
The services Dress Docs connects to, and what each one receives. You can see each of them in your browser's network tab.
- Page analytics (Umami, self-hosted) Our own Umami server at u.vzla.io, hosted at Hetzner in Falkenstein, Germany. It counts page visits on the site and web app without cookies. No personal data, no document content.
- Error reporting (Sentry, United States) On every page of the site and every visit to the web app, Sentry's error-reporting script is loaded from Sentry's servers. When something fails, it sends an error report to Sentry in the United States: technical details only (the error, page, browser, device type and IP address), no session replay, never document content.
- Phone app Sends error reports to Sentry on the same terms: technical details only, never document content. No page analytics.
- Accounts (Pro, Team, Organization) Sign-in and plan go to our account backend. Free uses no account.
- Payments (Stripe, merchant of record) Checkout and invoices for Pro, Team and Organization run on Stripe. Free sends nothing to Stripe.
How to verify it. The site's Content-Security-Policy header allows only four outside hosts: u.vzla.io (our analytics), js.sentry-cdn.com and browser.sentry-cdn.com (Sentry's CDN, which serves the error-reporting script) and Sentry's ingest (error reports). Your browser blocks every other outside host. You can read the header in the response headers of any page.
None of them receives your document. "Your document never leaves your device" refers to document content.
4Storage on the device
- Temporary (default). The document lives only in the open page and is cleared when it is closed or reloaded. ID copies are always temporary.
- Saved (opt-in, per document). Stored in this browser on this device, encrypted with a passphrase the user sets. It is not synced, backed up or exportable from the app. Dress Docs asks the browser for persistent storage and shows whether it was granted; the browser may still clear it.
- Delete everything on this device. Always one control away. It deletes saved work and destroys its key. We don't claim the device is left without any trace: deleting files on SSDs is not reliably complete.
- The redaction log (Pro) is saved by the user to their own file system, for their case file. It holds covers, reasons, pages and date, never document content.
5Redaction method: ISO/IEC 27038 self-assessment
ISO/IEC 27038 specifies digital redaction: removed information must not be recoverable, and nothing may stay hidden in parts of the file that aren't displayed. We assessed Dress Docs against it ourselves; no third party has audited it. The method also follows the ICO's guidance on disclosing documents securely.
| Requirement | How Dress Docs meets it |
|---|---|
| Removed content is not recoverable | Each exported page is rasterized into one image with the covers in it; nothing under a cover is written to the file. |
| No hidden text or layers | The export has no text layer, annotations, form fields or layers. The export check shows the text layer is empty. |
| No metadata | Author, title, producer, creator, dates and the document ID are cleared; image metadata (EXIF, XMP, IPTC) is not carried over. The export check shows it. |
| Covers can't be reversed | Covers are opaque. There is no blur or pixelation. |
| Reasons and record | Each cover can carry its reason (Pro); the redaction log records covers, reasons, pages and date, without document content. |
| Human review | Search and cover suggests matches in PDFs with a text layer; the user confirms each one. Nothing is covered automatically. |
Limits: search works only on PDFs with a text layer; scanned pages must be covered by hand.
6Accessibility statement
Dress Docs is built to WCAG 2.2 level AA. EN 301 549 references WCAG 2.1 AA; building to 2.2 AA covers those criteria.
This statement covers the Dress Docs site (dressdocs.vzla.io) and web app (app.dressdocs.vzla.io). Both can be used with a keyboard and assistive technology.
Known limitations. No formal accessibility evaluation has been published yet. When one finds limitations, we list them here, each with the date it was found.
Found a barrier? Write to support@vzla.io, with the page and what you were trying to do.
On the Organization plan, you can request a conformance report.
Statement prepared: October 18, 2026.
7What we don't claim
- No certification. Dress Docs holds no ISO 27001, BSI C5, SOC 2 or Cyber Essentials certification.
- Not "GDPR compliant" by itself. It helps you share and hold less personal data; compliance is your organization's, not a tool's.
- Not anonymization. A redacted file can still identify a person.
- Not for full-copy checks. Anti-money-laundering and similar checks require a full ID copy; the ID-copy preset warns before you redact for one.
- No offline or self-hosted version. Dress Docs needs an internet connection to open.
Report a security issue: support@vzla.io.
Need more for your review?
The Organization plan includes review calls and answers to your security and data protection questionnaires.