Document security, at the heart of React Box

React Box protects your accounting documents at several layers. Files are stored in a private bucket, never publicly exposed, and encrypted at rest with AES-256. Every view or download goes through a short-lived signed URL, so no permanent link circulates. Authentication is handled in-house by React Box, with no third-party provider, and two-factor authentication (2FA) is available on every account. Finally, every action on a document — upload, view, download, processing — is recorded in a timestamped audit trail, with the name of the person who performed it. It's these combined layers — private storage, encryption, signed access, 2FA and traceability — that keep your documents safe.

React Box data is hosted in the European Union. The application runs on modern serverless infrastructure: Cloudflare Workers for processing, a Neon database in the eu-central-1 region, and document storage on Cloudflare R2 under European jurisdiction. This ensures data residency in the EU and processing compliant with the GDPR, alongside Moroccan law 09-08 on personal data protection. Your accounting documents are neither resold nor used for advertising. You keep control of your data and can exercise your rights at any time. The details of hosting and sub-processors are set out in our legal notices and privacy policy.

Only the people you authorize. React Box applies role-based access control: you, your team members according to their role, and the accounting firm you've linked to your organization. Nothing is public, and a firm only accesses the files of the clients it is linked to. Every view, download or change is timestamped and recorded in the audit trail, with the identity of the person who performed it, so you always know who saw what and when. You can add or remove access at any time. This combination of granular permissions and complete logging avoids the accidental leaks common to email or messaging exchanges.

Yes. React Box is built to comply with the European GDPR and Moroccan law 09-08 on personal data protection. A data protection officer can be reached at dpo@react-box.com, and you can exercise your rights — access, rectification, portability, erasure — from the platform or on request. The vault is built to cover the ten years of retention required by Moroccan regulations, with the legal weight of the digital document; access to your documents remains conditional on an active subscription. Our legal notices detail the publisher (React Consulting SARL AU, Marrakech), hosting and sub-processors, and our privacy policy specifies the processing carried out. Compliance is not an optional module: it's built into the product by default.

React Box is designed for exactly these moments. Every scanned document keeps its evidentiary value — preserved integrity, timestamping and an action log — which makes it admissible in a DGI audit. You find a document instantly thanks to structured filing, tags and search, without digging through archive boxes. The complete audit trail traces who uploaded, viewed, downloaded or processed each document, and when. In a dispute with a supplier, a client or the authorities, you therefore have a clear, dated history. The vault is sized for the ten-year legal retention period: your documents stay available there for as long as your subscription is active, and you alone decide to delete one.

React Box relies on leading infrastructure providers rather than self-hosted servers. Compute, document storage and delivery run on Cloudflare (Workers and object storage), and the database is operated by Neon within the European Union. These providers maintain recognized certifications for their data centres and operations, including ISO/IEC 27001 and SOC 2 — assurance that the infrastructure layer is audited by independent third parties. Your documents are encrypted at rest (AES-256) and in transit (TLS), stored in a private bucket and reachable only through short-lived signed URLs. Authentication is handled in-house by React Box, with 2FA available, precise roles and permissions, and a timestamped audit trail. React Box does not claim a certification of its own at this stage: security rests on certified infrastructure, proven practices and full transparency about our subprocessors.