All uploaded documents are not directly available through the web. They are stored offline and only accessed by a script that verifies user authentication.
Safeguards to protect against threats such as SQL injection are also built into the software.
We are hosted with AWS (Amazon) who is one of the leading hosting companies in the world and takes security very seriously.