Security
Security built into every layer
What the platform does to keep your documents and data safe. We describe controls that exist today — no more.
Isolation
- Every record carries its organisation and client workspace. The application filters by them, and PostgreSQL row-level security enforces the same rule again, with the application connecting as a role that cannot bypass it.
- Stored files are kept under per-organisation and per-workspace prefixes; vector collections, agent memory and usage records are scoped the same way.
- Automated tests try every endpoint with another organisation's session and API key and expect to be refused.
Access
- Roles (owner, admin, member, viewer) with explicit permissions; API keys carry their own scopes and belong to one workspace.
- Passwords are hashed with Argon2; repeated failed sign-ins lock the account temporarily; sessions are server-side, in http-only cookies, with CSRF protection.
- API keys are shown once and stored only as a hash.
Data protection
- Accounting credentials are encrypted with AES-256-GCM under a data key wrapped by a master key that can be rotated.
- The production configuration serves everything over TLS, with HSTS and a strict Content Security Policy.
- Uploads are checked for type, size and archive safety (path traversal, nesting and decompression-bomb limits), and can be scanned for malware.
AI safety
- Agents run inside an Agent Harness with limits on steps, tokens, time and tool calls.
- Guardrails check model input and output, and every tool call against an allowlist; text inside documents is treated as data, not instructions.
- Side-effecting actions — publishing to your accounting software — run only after a person confirms the exact payload.
Accountability
- An append-only audit log records sign-ins, uploads, downloads, corrections, configuration changes, API-key use and publications.
- Every model call is traced and priced; budgets and alerts warn before costs run away.
Certifications
Document AI does not currently hold third-party security certifications such as SOC 2 or ISO 27001. If your organisation needs a security questionnaire answered, contact us.
Reporting a vulnerability
Please email security@documentai.local or use the contact form with the topic “Security”. We acknowledge reports and keep you informed while we fix them.
Process your first documents today.
Create an organisation, try the bundled sample documents, and call the API with your own key — in a few minutes.