Architecture

Northdocs is B2B SaaS for legal-grade document redaction and pseudonymization: detect personal data, support human review, permanently remove or replace sensitive content, then fail-closed verify before download. Cases / Redact is the primary product for FOI, DSAR, and litigation packs. Conversation Redact covers chats and meeting audio. Outbound Guard is optional Outlook send-time protection. Prompt Guard is clipboard wipe. The platform is built for law firms and public-sector disclosure teams.

Customer users authenticate (optionally via enterprise SSO) and use the Northdocs application hosted on OVHcloud in Frankfurt, Germany. TLS terminates at the Northdocs edge inside that boundary. Application, database, object storage, and queue tiers are segmented onto private networks, and heavy PDF/OCR work runs in an isolated container with no outbound internet access. Optional AI calls go over HTTPS to OVHcloud AI Endpoints only when the organization enables AI detection. Optional DMS/VDR connectors are authorized by the customer. Optional Outbound Guard runs in the customer's Outlook and calls the Northdocs API for cloud scan; mail bodies are not stored.

The diagram below shows trust boundaries: TLS into the Northdocs edge in Frankfurt, then paths for optional AI over HTTPS, the isolated PDF/OCR engine on a private network with no outbound internet, the application database and object storage in Germany, and optional customer-configured DMS/VDR connectors.

Document objects in OVH S3-compatible object storage (Germany) are encrypted at rest by the platform. Enterprise organizations can add application-layer envelope encryption and, optionally, Azure Key Vault bring-your-own-key (BYOK).

• Default: OVH Object Storage platform encryption for document objects (Germany / DE).
• Optional Enterprise envelope encryption: AES-256-GCM per document (DEK), wrapped by a per-organization key (org KEK), which is wrapped by a Northdocs platform root key.
• Optional Enterprise Azure Key Vault BYOK: the customer's CMK in their Azure Key Vault wraps the org KEK (wrapKey/unwrapKey). Northdocs never stores the CMK. This protects document file bytes at rest; it does not encrypt detections or page text in the application database, and processing still decrypts in memory.
• Org admins configure this under Settings → Organization. Setup guides: Help articles for envelope encryption and Azure Key Vault BYOK.

• Documents and derived content: Germany / European Union by default (OVHcloud Frankfurt compute, application database, object storage, and backups). Data region identifier: eu-de. US residency is not offered.
• Identity (Clerk): US/EU Clerk infrastructure. See Subprocessors.
• Transactional email: Scaleway Transactional Email (TEM) in the EU, including Clerk authentication and invitation messages. TEM receives recipient addresses, organization name on trial notices, and operational identifiers. It does not receive uploaded documents, document filenames, extracted text, detections, or case contents.
• Optional AI from the EU app: OVHcloud AI Endpoints when organization AI detection is enabled (NER, Magic, summaries, Prompt Guard names, Outbound Guard names, and Conversation Redact speech-to-text). Disable AI under Settings → Organization to keep that content on-platform only; audio then needs a caption sidecar.
• Optional Azure Key Vault BYOK: key material resides in the customer's Azure subscription (EU vault regions recommended). Document residency remains on OVH Germany / EU storage.

Documents move through a fixed sequence: upload, optional convert/OCR, extract, detect PII, review, apply, verify, then download. Conversation Redact parses chats or captions, or transcribes audio on OVHcloud AI Endpoints when AI is enabled and no sidecar is present. Outbound Guard inspects Outlook compose and attachments on Send; permanent file destruction remains a Cases job.

Deterministic validators (email, CPR/IBAN, and similar) run first. A named-entity tagger that runs inside the Northdocs hosting boundary then covers names, organizations, and locations on the extracted word boxes, with no AI provider involved. When the organization enables AI, optional models handle specialist categories (privilege, health narrative, Magic) after first paint. Humans accept identities (Fast Track). Apply uses content-stream removal (not an overlay) and rasterizes pages where a box covers image content. Verify re-extracts text, scans leftover file bytes, and fails closed.

Configurable organization retention (default 60 days, maximum 90 days) with per-case overrides. A scheduled sweep deletes object-storage objects and database rows. Audit logs are available with export on Firm+ plans.

Northdocs runs in a single EU region by design. Residency is a product commitment, so there is no cross-region failover that would move customer documents outside the agreed region.

• Automated daily database backups to EU object storage in the same region, on a rolling retention window. Backups inherit production residency and at-rest encryption.
• Document objects are stored redundantly by the object-storage platform within Germany.
• Restores are rehearsed on isolated scratch infrastructure over the private administrative network, never over live volumes.
• Retention deletion removes documents and derived data from production on schedule. Backup copies age out with the rolling backup window.
• Recovery time and recovery point objectives are not committed in standard Terms. Enterprise customers can agree targets in writing.

Physical, environmental, and datacenter certifications for the hosting estate are inherited from OVHcloud, which publishes its own certificates and audit reports. Northdocs controls the application, data, and access layers described above.

• Changes reach production through version control and peer-reviewed pull requests, with type checking and an automated test suite required before merge.
• Security properties are pinned by regression tests, including tenant isolation, fail-closed export, outbound URL filtering, crypto key handling, staff-console access, and API-key verification.
• Build pipeline actions are pinned to immutable commit revisions, and no third-party AI agent holds write-credentialed access to the pipeline.
• Dependency updates are automated and triaged. Production dependency licences and the PDF/OCR image pins are gated in continuous integration, and that image ships with a software bill of materials.
• Non-production environments run on separate hosts, databases, object-storage buckets, and secrets. Live customer documents are never copied into a test or development environment.
• Development conveniences such as local authentication bypasses and key fallbacks require an explicit local environment and fail closed everywhere else.

Northdocs triages and contains security and availability events on detection, and escalates anything involving customer personal data to security@northdocs.com and privacy@northdocs.com. For a personal data breach affecting customer personal data, Northdocs notifies affected customers without undue delay and supplies the information the customer needs for its own Article 33 and 34 obligations. The binding commitment is in the DPA. Post-incident review covers root cause and corrective actions, with a summary available to affected Enterprise customers on request.

SOC 2 / ISO 27001 certification: on the roadmap. Ask legal@northdocs.com for the latest status letter.

External penetration test: not yet available as a standard customer pack. Ask security@northdocs.com for current status.

Customer AI requests use OVHcloud AI Endpoints in the EU. AI can be disabled firm-wide under Settings (including Conversation Redact speech-to-text).

Uptime SLA: quantitative commitments are available on Enterprise by written agreement.

Customer-managed keys: Azure Key Vault BYOK is available on Enterprise (with envelope encryption). AWS KMS BYOK is not offered.

Security Overview · Security questionnaire · Enterprise AI Policy · Subprocessors · DPA.