Security
What you control, and what you can check.
The sealed file, the record, where data lives, and the certifications we do not hold. Built for a security review you can deep-link.
01
The sealed file is yours to verify.
One signature covers every byte you approved. Change anything later and the signature breaks. Check it in a normal PDF reader, offline, with no account and nothing of ours in the path.
The seal is a detached CAdES signature over the whole file, applied in-process when the document is sealed. The signing identity lives as a function environment secret in this version. There is no cloud key-management service and no managed certificate authority behind it yet.
What a reader sees: the signature covers the document, and it carries an RFC 3161 timestamp from DigiCert attesting when it was made. The issuer is not on a public trust list, so the reader will not mark the identity as trusted. We do not embed revocation data, so we make no long-term-validation claim and no claim about what the file reports in ten years.
Before seal, OctoDoc checks every mark for missing font glyphs. When an already-out legacy authored request reaches its last-signer seal, OctoDoc also compares its extracted text with its frozen source text. A failed check produces no artifact.
Validated by an independent library in CI — the code that seals never verifies its own output
02
The record cannot quietly lose a step.
Each event links to the one before it. Remove or change a step and the chain shows it.
The ledger is written through one bounded database function. There is no update path and no delete path for a tenant. A missing step is visible, not deniable.
Chain heads are anchored to an external RFC 3161 timestamp authority, DigiCert, on a five-minute schedule, and each response is archived with its certificate chain and a per-file audit path. The signing path fetches its own RFC 3161 timestamp from the same authority on every seal.
The ledger never goes to a logging or analytics vendor. Neither do document bytes or party personal data. No observability vendor is connected today.
03
Where your documents live.
One United States region. Private storage. No immutability claim we cannot support.
Every browser-facing surface is HTTPS only. The domain is submitted to the HSTS preload list and every response carries a preload Strict-Transport-Security header; once the listing ships in browsers, plain HTTP is refused before a request is made. Document bytes sit in private object storage. A browser reaches them only with a scoped, expiring grant. Bytes pass through the application only while a file is prepared, flattened or sealed.
Evidentiary writes are tenant-prefixed, content-addressed and refuse overwrite. A duplicate finalize converges on one artifact, and a replacement is detectable. That is not administrator-proof immutability. We make no WORM or Object Lock claim in this version.
An organization’s region is fixed at creation and cannot change later. EU and UK residency are not offered. Retention and deletion — including what survives an erasure request and why — live in the privacy notice, not in a summary that can go stale.
Privacy notice, sections 5 and 7 — published, indexable, no account required
04
What a model can see — and what it can never sign.
Every model request requires zero-data-retention routing and prompt-training opt-out.
That control is set on every model call the application makes: zero-data-retention required, routing restricted to one named provider. We do not claim that every related subprocessor agreement is already executed and filed.
Nothing a model produces can reach the signed bytes. The bytes that are flattened, hashed and sealed are exactly the file a human approved. The server re-measures the stored PDF before accepting mark placement, and send refuses an unconfirmed suggestion.
Ask Octo is local and deterministic. Its answers and citations live beside the document, and an answer with no matched location is not shown as a citation. It does not advise or create an automatic sender handoff.
05
One organization cannot reach another.
Row-level security is the floor. Application code never relies on it alone.
Every tenant table has row-level security enabled and forced, including for the table owner. The administrative role that can bypass those policies holds no table privilege, so a direct table read fails instead of succeeding for every tenant. Application code reaches tenant data only through bounded functions that take the organization as an argument. Zero affected rows is treated as failure, never as success.
The platform operator is not a data gate. Our console sees aggregate counts only — not tenant identifiers, personal data, document content, hashes, IP addresses or user agents. Support that truly needs customer data goes through a consent-bounded flow, or it does not happen.
Every route that serves document bytes, party names or a hash is excluded from search indexing in four independent layers. The exclusion list is declared once so those layers cannot disagree.
06
What we do not have yet.
Stated here so a review does not have to discover it elsewhere.
No ISO 27001 and no HITRUST.
No third-party accessibility report, and none booked. Target when commissioned: WCAG 2.2 AA on the signing path.
No penetration test and no bound insurance.
No custom roles: a workspace holds an owner and members, and nothing else.
No long-term validation claim.
No AATL cloud-signing certificate or archival signature profile.
No managed key custody. The v1 signing identity remains an in-process secret.
No SOC 2 Type II report. The observation window has not opened, and we have not set a date.
No SMS one-time-passcode signer check.
No government-ID or biometric signer check. An optional sender-set access code is a convenience control, not an independent identity check.
No long-term-validation (B-LTA) material inside the terminal proof file the product already assembles and returns.
No FRE 902 self-authentication claim. Counsel-approved certification templates ship inside the terminal proof file; the claim itself waits on the Records and Evidence Officer.
No single sign-on or SAML.
No SCIM provisioning.
No HIPAA posture and no business associate agreement. Do not send protected health information through OctoDoc.
No SEC 17a-4 retention posture.
No EU or UK data residency and no multi-region deployment. One United States region is fixed when the account is created.
07
Security questionnaire answers.
Short answers a diligence reviewer can deep-link. Each points at a published surface rather than inventing a claim.
Where is the product hosted?
Application and API on Vercel. Database, Auth and private object storage on Supabase in us-west-2. Outbound mail through Resend. Model calls through the Vercel AI Gateway to Anthropic under zero-data-retention routing.
Can we choose an EU or UK data region?
No. One United States region is fixed when the organization is created. Multi-region is not offered.
Is data encrypted in transit and at rest?
HTTPS only on every browser-facing surface; the domain is submitted to the HSTS preload list and every response carries a preload Strict-Transport-Security header. Object storage and the database use the provider's at-rest encryption. We make no separate customer-managed key claim in this version.
How is one customer isolated from another?
Every tenant table has row-level security enabled and forced. Application code reaches tenant data only through bounded functions that take the organization as an argument. Zero affected rows is treated as failure.
Do you train models on customer documents?
Application control: every model call requires zero-data-retention routing and prompt-training opt-out, restricted to Anthropic. An organization can also decline model processing for scanned-page reading.
Can AI change what gets signed?
No. Proposals, answers and citations live beside the document. The bytes that are flattened, hashed and sealed are exactly the file a human approved. Unconfirmed mark suggestions are refused at send.
What does the digital signature on the PDF mean?
One detached CAdES signature covers the whole sealed file. Change the bytes and the signature breaks. The issuer is not on Adobe's trust list in this version, so Acrobat will not mark the certificate as trusted. We report that honestly.
Do you have SOC 2, ISO 27001 or HIPAA?
No. None of those reports or a business associate agreement is held. Do not send protected health information through OctoDoc.
Have you had a penetration test?
No external penetration test is booked or published yet.
Do you support SSO or SCIM?
No single sign-on and no SCIM in this version. An organization has two roles and no more: one owner, and members. Membership is free and unlimited, so nothing is billed per person.
How are signers authenticated?
Default is an emailed link to a free account that must verify the invited address. A sender can require a separately delivered access code for an ordinary commercial file, but the code is sender-issued and is refused for employment and consumer files. SMS and government-ID verification are not in this version.
Who are your subprocessors?
The published subprocessor register on the Trust Center and in the DPA is the only list. It is versioned and cannot disagree with the privacy notice.
How long do you keep documents?
Hosted access runs for the published retention period; retention and deletion, including what survives an erasure request, are in the privacy notice. Separately, a sealed PDF you hold validates from the file itself, without an account and without OctoDoc. No surface promises hosting without end.
Do you offer a DPA?
Yes. The data processing agreement is published and indexable without an account.
Where is the status page?
status.octodoc.org on an independent host. It is named in the sender terms contact table, not as an availability warranty.
Can OctoDoc staff read our documents?
The operator console sees aggregate counts only — not tenant identifiers, personal data, document content, hashes, IP addresses or user agents. Support access that needs customer data is consent-bounded.
Can a counterparty verify a sealed file without an account?
Public verification is open at octodoc.org/verify with no account: paste a digest, or choose a file and it is hashed in the browser for a live comparison. A counterparty can also open the sealed PDF offline, read the signing-record pages, and compare the published SHA-256. The security posture page explains the seal.
Do you carry cyber or E&O insurance?
No. No cyber or errors-and-omissions policy is bound, and no certificate of insurance is published.
08
Who else can touch your document.
One register. The privacy notice and data processing agreement render the same list.
Vercel (including AI Gateway and Sandbox)
Application hosting, document processing, isolated Word conversion and transport for model calls
US · Document content: Yes — during Word conversion, preparing, flattening or sealing, and as bounded model context under required zero-data-retention routing
Supabase
Postgres, authentication and private object storage
US, us-west-2 · Document content: Yes — including page bytes in private Storage
Cloudflare
Authoritative DNS, the reverse proxy in front of Supabase authentication, database and storage, and inbound email routing
US · Document content: In transit only — every Storage upload and download crosses the reverse proxy, which terminates TLS and stores nothing
Resend
Account email, signature requests, reminders, sealed-copy delivery and inbound attachment intake on agents.octodoc.org
US · Document content: Document names and email content, plus a PDF emailed to the inbound address, which Resend holds until OctoDoc fetches it
Stripe
Subscription billing
US · Document content: No
Anthropic
Send-policy classification, launcher intent routing, extractive CLI summaries and routed-page transcription
US · Document content: Yes — bounded document content, and a rasterised page IMAGE for a page with no readable text layer, routed by the Gateway under required zero-data-retention and prompt-training opt-out controls
Timestamp authorities
RFC 3161 timestamp tokens from DigiCert on every seal and on five-minute ledger anchors
US · Document content: Hash only
At least 30 days’ notice before a subprocessor is added or replaced. You may object and terminate the affected subscription for a prorated refund if we proceed. Authoritative register: version 2026-09-05, effective 5 September 2026. The full current register is also in the Trust Center, the privacy notice and the data processing agreement.
09
Ask a specific question.
A pointed question gets a faster answer than a blank questionnaire — but we will complete a questionnaire, including the rows that are no.
Privacy and data protection: privacy@octodoc.org. Security incidents and vulnerability reports: security@octodoc.org. Every other address, and what each one answers, is on the contact page.
OctoDoc is unrelated to other businesses using the word octodoc, including a commercial printer and an unrelated consumer AI application. The operating entity and its registration will be published in the Trust Center once both exist.