Privacy Policy

For document data that institutions upload or issue through DocSec, the issuing institution is the data controller and DocSec acts as a data processor on its instructions. For website visitors, enquiries and account administration, DocSec is the controller.

• Account data: names, work emails, roles and organisation details of Key Users and staff.
• Document data: records and credentials issued by institutions, including holder details they contain.
• Verification data: verification requests, timestamps, requester details and outcomes.
• Technical data: IP addresses, device and browser information, and security and audit logs.
• Enquiry data: information you send us via the contact form or email.

• To issue, store and verify documents on behalf of institutions.
• To operate, secure, monitor and improve the platform.
• To bill for issuance, verification and licensing.
• To respond to enquiries and provide support.
• To meet legal, regulatory and audit obligations.

We process data to perform our contracts with institutions, to comply with legal obligations, for our legitimate interests in running a secure service, and with consent where required.

Data is encrypted with AES-256 at rest and TLS 1.3 in transit, documents are protected by SHA-256 verification keys, and access is role-based and logged in immutable audit trails. The platform undergoes annual third-party security assessment.

We do not sell personal data. We share it only with the issuing institution, with verifiers to the extent a verification requires, with vetted hosting and infrastructure providers under contract, and where required by law.

DocSec is hosted on Azure or DigitalOcean infrastructure. Where data moves across borders, we use appropriate safeguards such as contractual clauses with our providers.

Issued documents are kept for as long as the issuing institution instructs or its agreement requires. Audit logs are retained for three years. Enquiry data is kept only as long as needed to respond and maintain business records.

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing of your data, and to data portability. Requests about documents issued to you are best directed to the issuing institution; we will assist them. You may also complain to your local data protection authority.

This website uses only cookies and storage necessary for it to function and stay secure. We do not use advertising cookies.

We may update this policy. Material changes will be posted on this page with a new "last updated" date.