Security & Compliance
Cryptography that assumes everything can be attacked
DocSec is engineered so that fraud fails closed: change one bit of a verification key and the document no longer verifies.
Encryption everywhere
At rest — AES-256
All stored data is encrypted with AES-256 across the managed database and storage layers.
In transit — TLS 1.3
TLS 1.3 is enforced for every connection moving between client and server. Older protocols are not negotiated.
QR keys — SHA-256
Every QR code issued is sealed with a SHA-256-encrypted verification key. Verification fails on the slightest change to the key — tampering is detected, not tolerated.
Sessions — hardened state
Encrypted client-side state combined with server-side validation mitigates session hijacking, fixation and CSRF.
Access, authority & audit
Single Sign-On
Native SSO support where required: SAML 2.0, AD FS, Okta and Azure AD.
Role-Based Access Control
Granular permission settings that separate native document issuance authority from bulk EDMS ingestion and verification management — a System Administrator governs the institution; Department Admins govern their departments.
Immutable audit logging
Every create, read, update and delete is logged immutably and retained for 3 years for audit purposes.
Infrastructure you can audit
Multi-Availability Zone HA
Synchronous replication across 3 Availability Zones with zero data loss on a single data-centre failure; geo-redundant asynchronous replication to a DR region 500+ miles away. Growth tier and above run dedicated HA instances for a 99.99% zone-redundant SLA.
Self-healing compute
Stateless containers auto-scale across zones on CPU/memory load; automatic health checks replace failed instances without service interruption.
Data sovereignty
Enterprise tier can connect a customer-managed, self-hosted database and keep full control of the environment — with the trade-off that its replication and DR are the customer's responsibility.
Tiered backup & recovery targets
| Tier | Snapshots | Retention | RPO | RTO |
|---|---|---|---|---|
| Starter1–5 users | Full daily | 7 days | < 1 hour | < 8 hours |
| Growth6–20 users | Hourly incremental + daily full | 14 days | < 30 minutes | < 4 hours |
| Scale21–50 users | 30-min incremental + daily full | 14 days, geo-redundant | < 20 minutes | < 4 hours |
| Enterprise51+ users | 15-min incremental + daily full | 14 days, geo-redundant | < 15 minutes | < 4 hours |
RPO/RTO guarantees exclude self-hosted (customer-managed) databases.
Cybersecurity assurance
Independently tested, patched on a clock
Beyond certified infrastructure and fail-closed cryptography, the DocSec platform itself is audited every year by independent cybersecurity partners — and patched within guaranteed SLAs.
Annual independent assessment
The DocSec platform codebase undergoes an annual independent third-party security assessment — covering the OWASP Top 10, API security and dependency scanning — conducted by our cybersecurity partners. All platform-level fixes from the assessment are included.
Patch SLAs at no extra cost
Critical security patches are applied within a guaranteed SLA — Critical in under 24 hours, High in under 72 hours — at no additional cost to your organisation.
Dedicated penetration testing
Customers can request dedicated penetration testing of their isolated instance ([organisation-name].docsec.io). One test per year is included for Enterprise tier; additional audits are available at cost.
Attestation letter
A summary attestation letter from our annual security assessment is made available to Enterprise customers on request, under NDA.