Security

Your documents remain yours.

Gira was built to process your file, return the result, and forget it. See what happens to a document from upload to deletion.

Your file's journey

  1. Encrypted uploadAll traffic uses HTTPS with HSTS. No one in between can read the file.
  2. Isolated processingEach conversion runs in a separate process, with time and memory limits and no access to system credentials.
  3. Automatic deletionFiles and results are deleted from the server within 2 hours. Downloads are protected: only your account can access them.

Account protections

  • Strongly hashed passwordsPBKDF2-SHA256 with 600,000 iterations. No password is stored in plain text.
  • Protected sessionSigned, HttpOnly, Secure, and SameSite cookie with limited validity.
  • Against bots and brute forcePer-IP attempt limits, temporary lockout, and captcha after errors.
  • Against browser attacksCSRF protection, Content-Security-Policy, and blocking of embedding on other sites.
  • Social loginLog in with Google or Microsoft, without creating yet another password.
  • Verified uploadsFile type, size, and count are checked before any processing.

Transparent artificial intelligence

The AI summary, Translate PDF, and Chat with your PDF features send the necessary text from the document to our AI provider, Anthropic, in the United States. That's why:

  • Before each use, Gira shows this notice and only continues after you confirm.
  • No other tool sends content to AI.
  • Companies can turn off AI for all accounts in their domain.
  • In PDF chat, the document's text is treated as data: the AI is instructed to answer only based on it and to ignore commands written inside the file.

When signing with an A1 digital certificate, the certificate and password stay only in memory during signing and are never stored.

LGPD

We handle files only for as long as needed for the task you requested, with your acceptance recorded (date, time, and version of the terms). We don't use your documents for advertising or to train AI, and we don't sell data. You can request access, correction, portability, or deletion of your data through the Data Protection Officer (DPO) channel. Read the Privacy Policy, the Cookie Policy, and the data use terms.

If a security incident occurs that may pose a significant risk or harm, we notify the affected data subjects and the ANPD, as required by the LGPD.

Found a vulnerability? Contact us through the channel described in security.txt or by email at [email protected].