Security

Security practices

Procurement data is commercially sensitive. Here is how we protect it.

Infrastructure

  • Self-hosted on Hetzner VPS — no hyperscaler (no AWS, GCP, or Azure)
  • All services run inside Docker containers with no public-facing ports except HTTPS (443)
  • Private internal network for all service-to-service communication
  • Automated nightly backups — PostgreSQL schema + file storage — 30-day retention

Encryption

  • TLS 1.3 for all client-to-server and API traffic
  • AES-256 encryption for data at rest (database and file storage)
  • Encryption keys stored on-server, never in source code or environment variables committed to git
  • Secrets management via .env file, excluded from version control

Access control

  • Role-based access control: Viewer, Editor, Admin — enforced at API level, not just UI
  • Tenant isolation: each organisation's data is logically separated by tenant_id on all queries
  • JWT-based authentication with expiry and revocation on logout
  • Failed login rate limiting: 10 attempts per IP per 60 seconds

Application security

  • SQL injection prevented via parameterised queries (PostgREST / Supabase)
  • No string-interpolated SQL anywhere in the codebase
  • CORS restricted to authorised origins only
  • Input validation on all API endpoints via Pydantic models
  • AI pipeline rate limiting: 30 requests per tenant per hour
  • All user actions logged to an immutable audit log with timestamps

Compliance

  • DPDP Act 2023 (India) — data protection and user rights
  • GDPR Art. 17 right to erasure — account deletion anonymises PII without breaking audit trail
  • GDPR Art. 20 data portability — users can export their data
  • HIPAA-aligned controls for medical procurement vertical (no BAA yet — contact us)
  • SOC 2 Type II — formal assessment in progress (not yet certified)
  • ISO 27001 — formal assessment in progress (not yet certified)

Responsible disclosure

If you discover a security vulnerability in DocIQ, please report it privately before public disclosure. We take all reports seriously and will respond within 48 hours.

Email: hello@dociq.ai with subject line [SECURITY]

Please allow us 30 days to investigate and remediate before any public disclosure. We do not have a bug bounty programme at this time.