Security Questionnaire
Last updated: 7 September 2026
Northdocs ApS entity registration (CVR) is pending. These policies describe how the service operates today and are intended for customer due diligence. For a countersigned DPA or negotiated terms, contact legal@northdocs.com.
SIG-lite answers for vendor assessments. Related: Trust Center · Security Overview · Architecture · Enterprise AI Policy.
Northdocs ApS · For status letters or negotiated paper: legal@northdocs.com
1. Company & scope
| # | Question | Answer |
|---|---|---|
| 1.1 | Legal entity | Northdocs ApS, Rådhuspladsen 1, 1550 København, Denmark (registration pending until CVR is issued). |
| 1.2 | Product in scope | Northdocs SaaS: Cases / Redact (document redaction and pseudonymization), Conversation Redact (chats and meeting audio), optional Outbound Guard (Outlook send-time protection), Prompt Guard, cases, binders, connectors, and related APIs. |
| 1.3 | Primary hosting | OVHcloud in Frankfurt, Germany. The application, its database, object storage, queue tier, and the isolated PDF/OCR engine all run inside that EU boundary. Physical and datacenter certifications are inherited from OVHcloud. |
| 1.4 | Data region for customer documents | Germany / European Union by default (OVHcloud Frankfurt, data region eu-de). US residency is not offered. |
| 1.5 | Subprocessors | https://northdocs.com/subprocessors |
| 1.6 | DPA | https://northdocs.com/dpa (e-accept in-app or signed PDF). |
2. Certifications & assurance
| # | Question | Answer |
|---|---|---|
| 2.1 | SOC 2 | Not certified yet. Roadmap / status letter via legal@northdocs.com. |
| 2.2 | ISO 27001 | Not certified yet. Same status letter channel (legal@northdocs.com). |
| 2.3 | External penetration test | Not yet customer-shareable as a standard pack. Request status from legal@northdocs.com or security@northdocs.com. |
| 2.4 | Vulnerability disclosure | security@northdocs.com. See https://northdocs.com/security#vulnerability |
| 2.5 | Questionnaire / audit rights | Described in the DPA (annual + post-breach; certifications/questionnaires may satisfy). |
3. Identity & access
| # | Question | Answer |
|---|---|---|
| 3.1 | Customer auth | Clerk (email/password / social as configured). Self-serve billing uses Stripe Checkout; card numbers stay with Stripe. |
| 3.2 | SSO / SAML | Enterprise: Clerk Enterprise Connections (e.g. Microsoft Entra ID); org can Enforce SSO. |
| 3.3 | SCIM | Enterprise: Clerk Directory Sync (SCIM 2.0) on the tenant's SSO connection. IdP (e.g. Entra) provisions users into Clerk; Northdocs mirrors organization membership via webhooks. Optional IdP group → Clerk org role mapping (admin / member / reviewer). Enablement is coordinated per tenant. |
| 3.4 | MFA | Via Clerk and/or the customer IdP. Recommend enforcing MFA at the IdP for SSO organizations. |
| 3.5 | Roles | Organization roles admin, member, reviewer (billable) and viewer, security, billing (complimentary). Clerk stores admin or member only. Case assignee viewer/editor. |
| 3.6 | Connector credentials | Organization admins only may create, update, authorize, test, and delete DMS/VDR connectors. Editors may browse and import once connected. |
| 3.7 | Staff access to customer documents | Administration runs in a separate staff console that is not published to the public internet. Access requires an enrolled company device on a private administrative network plus authenticated staff identity. Support is ticket-driven; we do not browse customer documents as a matter of course, support access to document bytes is scoped to the ticket's organization, and staff actions are audit-logged. |
4. Data protection
| # | Question | Answer |
|---|---|---|
| 4.1 | Encryption in transit | TLS for browser, API, and service-to-service traffic. TLS terminates at the Northdocs edge inside the Frankfurt hosting boundary. |
| 4.2 | Encryption at rest | OVH Object Storage platform encryption (Germany); optional Enterprise per-document envelope AES-256-GCM. Platform-managed per-org KEKs wrap per-document DEKs. Optional Enterprise Azure Key Vault BYOK: see 4.6. |
| 4.3 | Tenant isolation | The tenant is the Clerk organization, and isolation is layered and fails closed. The organization is bound server-side from the authenticated session, API key, or share invite, never from a client-supplied parameter, so a tenant cannot be selected or forged by the caller. Every content read and mutation is scoped to that organization, and object-storage keys are namespaced per organization and re-asserted against the caller's organization before any bytes are served. A case ACL restricts documents further inside an organization (ethical walls). Membership and role are confirmed against the identity provider rather than trusted from a token claim, and a missing membership denies. Requests for records outside the tenant return not-found so existence does not leak. These properties are covered by regression tests in continuous integration. |
| 4.4 | Retention | Configurable (default 60 days, maximum 90 days) with automated deletion of documents and derived data. |
| 4.5 | Audit | Organization audit log; CSV/JSON export on Firm+ plans. |
| 4.6 | Customer-managed keys (BYOK) | Optional Enterprise Azure Key Vault BYOK. Customer CMK wraps the Northdocs organization encryption key (wrapKey/unwrapKey); Northdocs never stores the CMK. Requires envelope encryption. Protects document file bytes at rest in object storage only (not in-memory processing; detections and page text in the database stay readable for review). AWS KMS is not offered. Customer Azure Key Vault is customer-configured under the customer's Microsoft agreements. |
| 4.7 | Transactional email | Scaleway Transactional Email (TEM) in the EU delivers trial notices, support reply notifications, ops alerts, and Clerk authentication and invitation messages. TEM receives recipient addresses, organization name on trial notices, given name and auth codes or links on Clerk templates, and operational identifiers. Uploaded documents, document filenames, extracted text, detections, case names, and document attachments are not sent to Scaleway. See https://northdocs.com/subprocessors. |
| 4.8 | Outbound Guard telemetry | When Outbound Guard is deployed, Northdocs stores mailbox, finding counts, destination class, intent labels, and domains. Message bodies and raw CPR are not stored. Cloud scan may send compose snippets to the EU app (and to OVHcloud AI Endpoints when AI names are enabled). Complements M365 DLP; not a Purview replacement. |
5. AI / ML
| # | Question | Answer |
|---|---|---|
| 5.1 | Is AI required? | No. Deterministic detectors run without an AI provider. |
| 5.2 | AI vendor | Optional OVHcloud AI Endpoints when organization AI detection is enabled, from the EU-hosted application: NER, Magic, summaries, Prompt Guard names, Outbound Guard names, and Conversation Redact speech-to-text. See https://northdocs.com/ai-policy. |
| 5.3 | AI provider retention | Production AI uses OVHcloud AI Endpoints in the EU. Customers can disable AI firm-wide under Settings → Organization, which also turns off Conversation Redact speech-to-text (upload a caption sidecar instead). Questions: support@northdocs.com. |
| 5.4 | Customer kill-switch | Settings → Organization → disable AI / ML detection. Prompt Guard AI assist, Outbound Guard AI names, and Conversation Redact speech-to-text honor the same switch. |
6. Application security
| # | Question | Answer |
|---|---|---|
| 6.1 | Redaction integrity | Content-stream redaction (not overlay) plus fail-closed re-extract verification before download. Conversation Redact apply fails closed when accepted strings still appear in the transcript, or when a silence, beep, or anonymized span does not change the audio. |
| 6.2 | Upload controls | MIME allowlisting and magic-byte sniffing; size/page ceilings on the PDF engine. |
| 6.3 | Outbound URL controls | Webhook, connector, and Azure Key Vault URLs are validated in the application: HTTPS only, with loopback, private, link-local, carrier-grade NAT, and cloud metadata destinations refused. Hostnames are resolved before the request so a public name cannot be pointed at an internal address. Outbound traffic then leaves through an allowlisted egress proxy that re-applies the same denies after DNS resolution. Optional Enterprise private connectors to on-premise ESDH/DMS systems run over a self-hosted, open-source WireGuard-based overlay network that Northdocs operates on its own EU infrastructure (no third-party VPN service), with mesh access control limited to the Northdocs gateway and no public URL required on the customer system. Arbitrary private addresses stay blocked without an active private link. |
| 6.4 | Rate limiting | Rate limits apply to interactive routes, upload, export and share, interactive AI, and REST API-key traffic, enforced per IP address, per organization, and per API key. Thresholds are tuned per route class and are not published. |
7. Integrations
| # | Question | Answer |
|---|---|---|
| 7.1 | DMS / VDR | SharePoint, OneDrive, iManage, HighQ, Datasite, Danish ESDH (WorkZone, Nova, F2/cBrain, Acadre, SBSYS, GetOrganized), S3-compatible object storage, and webhook pull on Trial and Enterprise. |
| 7.2 | Who authorizes connectors? | Customer organization admin. Customer-configured DMS/VDR vendors are governed by the customer’s own agreements. |
| 7.3 | Outbound Guard (Outlook) | Outlook Outbound Guard add-in (send-time personal-data scan, wipe/tokenize, SoftBlock on send, confidential-intent review, IT Ops alerts) via Microsoft 365 Centralized Deployment. Available on Outbound Guard, Enterprise, and Trial. Complements M365 DLP; not a Purview replacement. Word/Excel Office.js add-ins are not shipped; disclosure DOCX/XLSX uses the web app native output path. |
| 7.4 | On-prem / private network connectors | Optional Enterprise (and Trial) feature, enabled per tenant. Private on-premise ESDH/DMS links use a self-hosted, open-source WireGuard-based overlay network that Northdocs operates on its own EU infrastructure; no third-party VPN service is involved. The customer installs an outbound agent, so the source system needs no inbound firewall rule and no public URL, and Northdocs reaches the private API over the mesh only. Public HTTPS connectors remain the default path. Deployment specifics are shared during Enterprise onboarding. |
8. Availability & support
| # | Question | Answer |
|---|---|---|
| 8.1 | Public uptime SLA | Not guaranteed in standard Terms. Quantitative Enterprise SLA only if agreed in writing on an Order Form / Enterprise agreement. |
| 8.2 | Status page | A public status page is forthcoming. Incident notices for affected customers go through support and email. The page will cover the app, OVHcloud AI Endpoints, Clerk, and the PDF/OCR container once it is live. |
| 8.3 | Support | In-app support for subscribed plans. Enterprise response targets are set in the commercial agreement when applicable. |
| 8.4 | Security / privacy contacts | security@northdocs.com · privacy@northdocs.com · legal@northdocs.com |
9. Resilience & recovery
| # | Question | Answer |
|---|---|---|
| 9.1 | Backups | Automated daily database backups to EU object storage in the same region, on a rolling retention window. Document objects are stored redundantly by the object-storage platform within Germany. |
| 9.2 | Backup residency and encryption | Germany / European Union. Backups inherit production residency and platform at-rest encryption. Documents protected by Enterprise envelope encryption remain wrapped in backup. |
| 9.3 | Restore testing | Restores are rehearsed on isolated scratch infrastructure reached over the private administrative network, never over live volumes. |
| 9.4 | Deletion versus backups | Retention deletion removes documents and derived data from production on schedule. Backup copies age out with the rolling backup window rather than being edited in place. |
| 9.5 | RTO / RPO | Not committed in standard Terms. Enterprise targets can be agreed in writing (legal@northdocs.com). |
| 9.6 | Disaster recovery scope | Single EU region (Frankfurt) by design. Cross-region failover is not offered because it would move customer documents outside the agreed residency region. |
| 9.7 | Data return and deletion on termination | Export your redacted outputs, cases, and audit logs before the subscription ends. After termination, documents and derived data are deleted per the DPA and the organization retention policy; backup copies age out with the backup window. |
10. Secure development & change management
| # | Question | Answer |
|---|---|---|
| 10.1 | Change control | Changes reach production through version control and peer-reviewed pull requests. Type checking and an automated test suite must pass before merge, and deploys are built from the reviewed revision. |
| 10.2 | Security regression tests | Tenant isolation, fail-closed export and verification, outbound URL filtering, encryption key handling, staff-console access, admin CSRF protection, and API-key verification each have pinned tests that run in continuous integration. |
| 10.3 | Dependency management | Automated dependency update pull requests with triage. Production dependency licences and the PDF/OCR image pins are gated in continuous integration, and that image ships with a software bill of materials. |
| 10.4 | Build pipeline integrity | Pipeline actions are pinned to immutable commit revisions, and no third-party AI agent holds write-credentialed access to the build pipeline. |
| 10.5 | Static analysis | Type checking and the targeted security regression tests above run today. Broader automated static analysis is on the hardening roadmap; we do not claim it yet. |
| 10.6 | Environment separation | Non-production environments run on separate hosts, databases, object-storage buckets, and secrets. Live customer documents are never copied into a test or development environment. Development conveniences such as authentication bypasses and key fallbacks require an explicit local environment and fail closed everywhere else. |
| 10.7 | Personnel and access management | Production and staff-console access is limited to a named list of Northdocs personnel under confidentiality obligations, granted least privilege, reviewed periodically, and revoked on role change or departure. Northdocs is a small team, so the named list is short and reviewable on request under NDA. |
| 10.8 | Secrets management | Production secrets are stored encrypted with restricted permissions on the hosting estate and are available only to named operators. Customer connector credentials and document keys are encrypted at rest in the application, and key material is rotatable. |
11. Incident response
| # | Question | Answer |
|---|---|---|
| 11.1 | Breach notification | Northdocs notifies the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and supplies the information the customer reasonably needs for its own Article 33 and 34 obligations as it becomes available. The binding commitment is in the DPA (https://northdocs.com/dpa). |
| 11.2 | Notification channel | Organization administrators by email and through in-app support. Keep a current security contact on file so notices reach the right person. |
| 11.3 | Escalation contacts | security@northdocs.com for security events, privacy@northdocs.com for data protection. |
| 11.4 | Post-incident review | Root cause and corrective actions are reviewed after an incident. A summary is available to affected Enterprise customers on request. |
| 11.5 | Regulatory assistance | Northdocs assists with breach assessment, data protection impact assessments, and supervisory authority consultations, taking into account the information available to us. Assistance beyond standard product features may be chargeable as described in the DPA. |
| 11.6 | Logging and detection | Application and infrastructure logs are centralized on a rolling retention window and are queryable only by authorized staff over the private administrative network. Customers additionally get an organization audit log with export on Firm+ plans. |