Security

Security is treated as a system boundary rather than a badge. Doculate's production design limits public routes, keeps the workspace behind authentication, stores document objects privately, and records the lineage needed to investigate how a document was produced.

The Service is currently an actively developed private preview. Controls will evolve with the product, its audience, and the sensitivity of workloads it is asked to handle. Any organisation considering regulated, privileged, or unusually sensitive data should contact us for a specific assessment before use.

The intended production boundary separates responsibilities across a small number of managed services:

• Application hosting and delivery for the web application, HTTPS edge delivery, server-side routes, background processing, and encrypted environment configuration;
• Managed database storage for structured projects, evidence, provenance, reviews, version metadata, and execution records;
• Private object storage for original sources, parsed representations, context objects, attestations, and generated exports; and
• Separate parsing and connector services for bounded document conversion or authorised imports where those features are configured.

Source bytes do not need to be carried inside background processing jobs; jobs can refer to identifiers and hashes while the private object remains in storage. Structured records and document objects are separated so access and recovery can be scoped to their different functions.

Production workspace and application routes are intended to require an authenticated identity. That check runs before a request reaches project data, and it fails closed: a request that cannot be authenticated is refused rather than served a reduced view. Public landing, trust, health, and narrowly scoped upload routes are handled separately, and carry no workspace content.

Security measures in the current design include:

• server-only credentials stored in the hosting provider's protected environment configuration;
• private object access rather than public document URLs;
• authenticated downloads with private, no-store response caching;
• short-lived, purpose-bound upload authorisation for direct browser uploads;
• separate credentials for database, storage, parsing, AI, email, and connectors; and
• production checks that keep the private-preview entry point unavailable until required storage and authentication are configured.

We aim to limit operational access to people and services that need it. No access model prevents every mistake or compromised credential, so access is paired with logs, bounded service roles, and incident response.

Doculate's security model includes integrity and provenance, not only confidentiality. Controls include immutable source snapshots, content checksums, version hashes, explicit parent-child lineage, conflict-safe branch updates, idempotency controls, and a record of execution events that preserves order and is not silently rewritten.

These records are designed to make an unexpected or conflicting change visible, tie an export to the version that produced it, and support investigation or reconstruction. Evidence and reference material are kept in different logical roles so a third-party document is not silently treated as proof about the user.

PDF and DOCX conversion, email, optional drive connections, and AI-assisted features may require selected content to move through a specialist provider. We configure only the services needed for an enabled feature and aim to send the minimum material reasonably required for that operation.

Provider credentials are kept server-side or within the connector service. We assess providers in proportion to their role, including their access controls, encryption commitments, data handling, incident practices, and deletion options. The current provider categories and international-processing information are listed in the Privacy notice.

Operational safeguards are intended to include:

• health checks for database, private object storage, and parser availability;
• separate production and preview data boundaries where deployed;
• bounded retries and a record of progress for long-running document work;
• dependency updates, automated tests, and review of security-relevant changes;
• rate limiting or abuse controls on exposed endpoints where appropriate; and
• investigation, containment, recovery, and notification when a material incident is identified.

If a personal-information breach is likely to cause serious harm, we will take steps required by applicable law, which may include notifying affected people and the New Zealand Privacy Commissioner. The timing and detail of any notice will depend on what is known and what disclosure is safe.

Security is shared. You should:

• use unique, strong credentials and do not share private-preview access;
• secure the device, browser, email account, repository, and drive used to reach Doculate;
• upload only necessary material and remove secrets or unrelated personal information where practical;
• review connector permissions and revoke access you no longer need;
• check downloaded documents before distributing them and preserve independent copies of irreplaceable sources; and
• tell us promptly about suspected account compromise, unintended disclosure, or incorrect access.

Do not send passwords, API keys, private keys, payment-card data, or authentication codes inside prompts or source documents unless the feature expressly requires that data and you have confirmed an appropriate security arrangement with us.

If you believe you have found a security vulnerability, email doculate@anphase.co.nz with “Doculate security report” in the subject. Include the affected route or feature, impact, reproducible steps, and any supporting detail that does not expose another person's data.

When researching or reporting an issue:

• avoid accessing, changing, retaining, or sharing content that is not yours;
• do not disrupt the Service, degrade availability, or use destructive testing;
• stop and report if you encounter credentials or personal information;
• allow reasonable time for investigation and remediation before public disclosure; and
• comply with the Acceptable Use Policy and applicable law.

We will acknowledge a credible report, keep you informed when practical, and work in good faith with researchers who follow this process. Doculate does not currently operate a paid bug bounty or promise a reward.

No architecture, provider, encryption control, test suite, or policy can eliminate all risk. This page is a description of the current intended posture, not a warranty, external audit, penetration-test report, or certification of compliance with a particular security standard.

We will update this page when material controls or providers change. For security questions or a pre-use assessment, contact doculate@anphase.co.nz.