SquirrelDocs is a pass-through, not a permanent vault. Files move from your client to you through SquirrelDocs, and then they are deleted on the schedule you choose: 30, 60, or 90 days. You set the window per firm. When deletion happens, you can get a Deletion Certificate confirming it.
Before a client uploads anything, you can send them our Pre-Link Trust Sheet — a plain-English one-pager, in your firm's name, explaining what the link is, what happens to their files, and when files are deleted.
A client's link can also carry an optional 4-digit PIN, set per client: turn it on for the clients who want the extra step, leave it off for the rest, and reset it at any time from the client's page.
Inside your firm, access is role-based. Every person signs in with their own email and password. The account owner and managers see the whole firm; each staff member sees only their own clients — their lists, files, and numbers — and can't open another team member's clients, even by guessing a link. Billing and account closure belong to the account owner alone. Sign-ins and actions are written to your firm's audit log, with the person who took them.
For each list, download a Chain-of-Custody Receipt: every file, who uploaded it, for which period, and when — a record you can keep for the close, or share with the client.
On SOC 2 — our honest line: SquirrelDocs is not yet SOC 2 certified. We run SOC 2-aligned controls on audited infrastructure, and we will tell you exactly which controls are in place today if you ask by email. We will not dress that up as certification.
Email Us for the Security Packet
The packet: data flow diagram, retention/deletion policy, sub-processor list, Trust Sheet sample.
SquirrelDocs