Trust & Security
Security and compliance at Documind
Documind processes invoices, customs declarations, contracts, and other sensitive business documents. This page tells you how we protect that data, where it is processed, and what our compliance status is today.
Compliance status
GDPR
We process personal data of EU/EEA residents in line with the GDPR.
KVKK
We process personal data in line with KVKK, the Turkish personal data protection law.
SOC 2 Type II
An independent SOC 2 Type II attestation is in progress. It is not complete yet.
Data protection
Your documents are business-critical. We protect them at every step.
Encryption in transit
All traffic to the Documind app and API is encrypted with TLS.
Encryption at rest
Stored documents and extracted data are encrypted at rest.
EU and AU data residency
Enterprise customers can keep processing in EU or AU data residency endpoints.
Zero data retention option
Enterprise customers can sign a zero data retention agreement, so documents are not stored after processing.
Access control
Control who can see and change your data.
SSO and SAML
Enterprise teams sign in through their identity provider with SAML-based single sign-on.
Role-based access control
Give each user only the permissions that their role needs.
Audit logs
User activity is recorded, so you can review who did what and when.
Deployment options
Run Documind where your security policy requires.
Managed cloud
The default option. We operate the platform, and you use the app or the REST API.
VPC or on-premise
Enterprise customers can deploy Documind in their own virtual private cloud or on-premise.
Accuracy and human oversight
AI output that you can check and trust.
Field-level confidence scores
Each extracted field has a confidence score and a reference to its location in the source document.
Human-in-the-loop review
Low-confidence fields are flagged for human review. They are not passed through silently.
Responsible disclosure
If you find a security vulnerability in Documind, tell us. Email support@documind.cloud with the subject line "Security disclosure". Include the steps to reproduce the issue and its possible impact.
- Do not access, change, or delete data that is not yours.
- Do not run tests that can degrade the service for other customers.
- Give us reasonable time to fix the issue before you disclose it publicly.
Security FAQ
Is Documind SOC 2 certified?
A SOC 2 Type II attestation is in progress; it is not complete yet. Documind is aligned with GDPR and KVKK (the Turkish data protection law).
How does Documind encrypt my documents and data?
Data is encrypted in transit with TLS and encrypted at rest. Access to customer data is restricted by role-based access control, and access is recorded in audit logs.
Where is my data stored and processed?
You choose. Documind runs on your own servers, also without internet, or in your own virtual private cloud (VPC). In our cloud, Enterprise customers can choose EU or AU data residency.
Can Documind delete my documents after processing?
Enterprise customers can sign a zero data retention agreement, so documents and extracted data are not stored after processing. Contact sales for the terms that apply to your plan.
Does Documind support SSO and access control?
Yes. Enterprise plans include single sign-on with SAML, role-based access control for teams, and audit logs of user activity.
How do I report a security vulnerability?
Email support@documind.cloud with the subject line "Security disclosure". Include the steps to reproduce the issue. Please give us reasonable time to fix the issue before you disclose it publicly.
Need a security review or a DPA?
Our team can answer security questionnaires and share the details that your procurement process needs.