Responsible disclosure
If you believe you’ve found a security vulnerability in Docusift, please report it to hello@docusift.co. We acknowledge reports within 2 business days and provide a substantive response within 7 business days.
Please don’t exploit the vulnerability beyond what’s necessary to demonstrate the issue, don’t access customer data that isn’t yours, and give us a reasonable window to remediate before public disclosure. We do not currently run a paid bug-bounty program, but we are happy to credit researchers publicly with their permission.
How we protect customer data
Encryption
- In transit: all traffic is encrypted with modern TLS. HSTS is enforced in production.
- At rest: customer documents and extracted data are encrypted at rest. Sensitive secrets and credentials get an additional application-layer encryption key.
- Webhooks:outbound webhooks are signed so your endpoint can verify they came from us and weren’t altered in flight.
Workspace isolation
- Every request is scoped to the calling workspace. Cross-workspace access is prevented at the data layer.
- API keys are workspace-scoped — a key from one workspace cannot read another workspace’s data.
- Bring-your-own storage is available on Enterprise.
Authentication
- Multi-factor authentication is available on every account and can be required for sensitive actions.
- Single sign-on is available for Enterprise customers, with per-workspace identity-provider configuration.
- Sessions are revocable; users can review and revoke active sessions from their profile.
- Locked out of MFA? Use a recovery code from the set you saved when you enrolled. If you lost the codes, email hello@docusift.cofrom the account’s registered email. A workspace admin will verify your identity by inviting you to a 1:1 video call and comparing the photo-ID on file, then reset MFA on your account from the admin panel. Plan for 1 business day; no SMS or voice-OTP fallback is used.
Resilience & recovery
- Encrypted point-in-time backups of the production database with 30-day retention. Object storage versioning is on for customer-uploaded documents.
- Recovery Point Objective (RPO): 5 minutes for the production database; uploaded documents are durable to the last successful write to S3 (eleven-nines durability).
- Recovery Time Objective (RTO): 4 hours for a full region-loss scenario, measured to first-byte of restored service. Single-AZ outages are recovered automatically. Documented procedure in our internal runbook; quarterly tabletop is held against the published RTO.
- Subprocessor list is published, and we notify customers at least 30 days before adding a new subprocessor that handles customer data.
Privacy
- We do not train AI models on your documents. Document content is sent to Microsoft Azure AI Foundry for large-language-model inference under the Microsoft Online Services Terms and the Microsoft Products and Services Data Protection Addendum. Under those terms, your data is not used to train Microsoft’s or any third-party foundation model, is not shared with the underlying model provider for their own purposes, and is processed solely to return the inference response. See the subprocessors page for the contract chain.
- Data export and account deletion are self-service. See our privacy policy for details.
Subprocessors
Docusift uses subprocessors in the categories below. Customers are notified at least 30 days in advance of any new subprocessor that processes their documents or extracted data.
| Category | Purpose |
|---|
| Cloud infrastructure | Compute, managed database, and object storage that power the service. |
| AI inference | Document understanding and structured-data extraction. Enterprise customers can route inference to dedicated or self-hosted environments. |
| Email delivery | Transactional emails — sign-in, alerts, billing receipts. |
| Payment processing | Billing data only. Payment processors never receive customer documents or extracted content. |
The current named subprocessor register is available under DPA — email hello@docusift.coto request it. Customer-initiated integrations (e.g. QuickBooks, Xero) are not subprocessors of Docusift in the GDPR sense — the customer is the data exporter; we are the data sender on the customer’s behalf.
Security & compliance posture
We design and operate against widely-accepted security frameworks and care deeply about getting this right. We are not yet third-party audited; formal attestation is on our roadmap. In the meantime, we’re happy to walk customers through our controls and complete security questionnaires under NDA.
- GDPR: data export and deletion are self-service. All customer data is currently hosted in the United States; EU data residency is not yet available — contact us if it is a procurement requirement.
- HIPAA: not currently in scope. Reach out if your use case requires a BAA — we evaluate case by case.
Contact
Security questions, vulnerability reports, or DPA requests: hello@docusift.co.
Our public security disclosure file is at /.well-known/security.txt (RFC 9116).