Security Overview

Northdocs is built for law firms and public-sector teams that handle sensitive documents. The design goal is fail-closed redaction: exports must not silently leak content that still has pending detections or surviving sensitive strings. This overview summarizes technical and organizational measures; the Trust Center links the full diligence set, and the DPA and Privacy Policy remain the binding descriptions of roles and processing. Trust Center · DPA · Privacy Policy · Architecture · Enterprise AI Policy · Security Questionnaire.

• Hosted on OVHcloud in Frankfurt, Germany. The application, its database, object storage, and queue tier all run inside that EU boundary, and customer documents use EU data residency by default (data region eu-de). US residency is not offered.
• Encryption in transit (TLS) and encryption at rest for OVH Object Storage, with optional Enterprise envelope encryption and Azure Key Vault BYOK.
• Network segmentation between the public edge, application, and data tiers, hardened hosts, and application security headers with a Content Security Policy.
• Tenant isolation via organization IDs and namespaced storage keys.
• The PDF/OCR engine runs in an isolated container on a private network with no outbound internet access.
• Physical, environmental, and datacenter certifications for the hosting estate are inherited from OVHcloud, which publishes its own certificates and audit reports. Northdocs controls the application, data, and access layers on top.

• Authentication and organization membership via Clerk, with optional Enterprise SSO/SAML and Enforce SSO.
• Role-based access (admin, member, reviewer, viewer, security, billing) and case assignment controls.
• API keys scoped to organizations; webhooks for automation on eligible plans.
• Upload allowlisting by MIME type and magic-byte sniffing, with size and page ceilings on the processing engine.
• Audit logging of key administrative and document actions; CSV/JSON export on Firm+ plans.
• Rate limiting on interactive, export, AI, and REST API-key routes, applied per IP address, per organization, and per API key.
• Requests to customer-supplied URLs (webhooks, connectors, key vaults) must be HTTPS, are resolved before the request is made, and are refused for loopback, private, link-local, and cloud metadata destinations. Outbound traffic leaves through an allowlisted egress path.
• The tenant is bound server-side from the authenticated session, API key, or share invite. A client cannot select its own organization, and object-storage keys are re-asserted against that organization before any document bytes are served.

• Configurable retention with automatic deletion of documents and extracted data.
• Fail-closed download/export when detections remain pending (authorized override only).
• Redaction certificates and verification steps in the processing pipeline.
• Share links limited to completed redacted outputs.
• Optional Enterprise per-document envelope encryption (AES-256-GCM) for document objects in OVH Object Storage, in addition to OVH platform at-rest encryption. Detections and page text in the database remain cleartext for search and review.
• Optional Enterprise Azure Key Vault BYOK: your customer-managed key wraps the Northdocs organization encryption key (not each document). Northdocs never stores the CMK. At-rest object storage only; processing still decrypts in memory. Configure under Settings → Organization; see Architecture and Help for setup.
• Content-stream redaction (not overlay) plus fail-closed re-extract verification. Download is refused if sensitive strings survive anywhere a reviewer did not deliberately keep them.
• Outbound Guard telemetry (when deployed) stores mailbox, finding counts, destination class, and domains. Message bodies and raw CPR are not stored.

Optional semantic NER, Magic, summaries, Prompt Guard names, Outbound Guard names, and Conversation Redact speech-to-text use OVHcloud AI Endpoints from the EU-hosted app when AI detection is enabled. Administrators can disable AI / ML detection under Settings → Organization so that only on-platform detectors run and speech-to-text stays off. See the Enterprise AI Policy. Enterprise AI Policy · Subprocessors.

Northdocs runs in a single EU region by design. Residency is a product commitment, so there is no cross-region failover that would move your documents outside the agreed region.

• Automated daily database backups to EU object storage in the same region, on a rolling retention window. Backups inherit production residency and at-rest encryption.
• Document objects are stored redundantly by the object-storage platform within Germany.
• Restores are rehearsed on isolated scratch infrastructure over our private administrative network, never over live volumes.
• Deletion under your retention policy removes documents and derived data from production on schedule. Backup copies age out with the rolling backup window.
• Recovery time and recovery point objectives are not committed in standard Terms. Enterprise customers can agree targets in writing; ask legal@northdocs.com.

• Changes reach production through version control and peer-reviewed pull requests, with type checking and an automated test suite required before merge.
• Security properties are pinned by regression tests, including tenant isolation, fail-closed export, outbound URL filtering, crypto key handling, staff-console access, and API-key verification.
• Build pipeline actions are pinned to immutable commit revisions, and no third-party AI agent holds write-credentialed access to the pipeline.
• Dependency updates are automated and triaged. Production dependency licences and the PDF/OCR image pins are gated in continuous integration, and that image ships with a software bill of materials.
• Non-production environments run on separate hosts, databases, object-storage buckets, and secrets. Live customer documents are never copied into a test or development environment.
• Development conveniences such as local authentication bypasses and key fallbacks require an explicit local environment and fail closed everywhere else.

• Least-privilege access to production. Production secrets are stored encrypted, with restricted permissions, and are available only to named operators.
• Application and infrastructure logs are centralized on a rolling retention window and are queryable only by authorized staff over our private administrative network.
• Production administration runs on a separate staff console that is not published to the public internet. Access requires an enrolled company device on that private network plus authenticated staff identity.
• Support access is ticket-driven; we do not browse Customer documents as a matter of course. Support access to document bytes is scoped to the ticket's organization and is audit-logged.
• Staff administrative access and customer organization roles are reviewed periodically, and staff access is revoked on role change or departure.
• Dependency and container hygiene for the PDF/OCR processing path.
• Formal SOC 2 / ISO 27001 certification roadmap: ask legal@northdocs.com for the current status letter. An external penetration test report is not yet available as a standard customer pack; ask security@northdocs.com for status. Public diligence set: Trust Center, Architecture, Enterprise AI Policy, and Security Questionnaire.

Northdocs triages and contains security and availability events on detection, and escalates anything involving Customer Personal Data to the security and privacy contacts below.

• For a personal data breach affecting Customer Personal Data, we notify affected customers without undue delay and supply the information you need for your own Article 33 and 34 obligations, as it becomes available.
• Notices go to organization administrators by email and through in-app support. A public status page is forthcoming for service-wide availability events.
• Post-incident review covers root cause and corrective actions. A summary is available to affected Enterprise customers on request.
• We will assist you with your own breach assessment, data protection impact assessments, and supervisory authority consultations, taking into account the information available to us.

The binding notification commitment is in the DPA.

Please report security issues privately. Do not open a public issue for exploitable vulnerabilities.

• Include affected component (main app, admin, PDF container, REST API, connector), reproduction steps, impact, and whether customer data is involved.
• We aim to acknowledge reports within 2 business days and provide a status update within 10 business days.
• Coordinated disclosure timelines are negotiable for complex issues.
• Good-faith researchers who avoid privacy violations, do not retain customer document content beyond demonstration needs, and report promptly are covered by our safe-harbor expectations.

Email vulnerability reports to security@northdocs.com.

• Manage user access, SSO, and offboarding promptly.
• Configure retention and AI settings to match your policies.
• Complete human review before external disclosure.
• Authorize DMS/VDR connectors only to approved repositories (organization admins manage connector credentials).
• Keep a signed DPA on file under Settings → Compliance.
• If Azure Key Vault BYOK is enabled, manage the CMK, Key Vault RBAC, and vault availability so encrypted documents remain readable.
• If Outbound Guard is deployed, keep Outlook policy, trusted domains, and deployment XML current. If AI / ML detection is disabled, Conversation Redact audio needs a WebVTT or SubRip sidecar.
• Subscribe to subprocessor change notices if your policies require advance review, and keep a current security contact on file so breach notices reach the right person.

Security / vulnerability reports: security@northdocs.com · privacy@northdocs.com · legal@northdocs.com.