DocAccess Security & AI FAQs

DocAccess runs on Amazon Web Services (AWS) in U.S. regions only.

DocAccess processes documents retrieved from publicly accessible URLs and documents uploaded directly through the application. Your organization controls what DocAccess processes in both cases.

After processing, DocAccess stores a copy of the original document and its accessible transcription in our infrastructure to serve the viewer and transcript. Documents are not re-fetched from your servers on each view, the stored copy ensures consistent availability and performance regardless of changes to the source URL.

DocAccess is primarily used to process documents intended for public consumption, meeting agendas, budgets, ordinances, resolutions, and similar records. Your organization is responsible for determining that the content of any document submitted to DocAccess is appropriate for processing.

• Criminal Justice Information (CJI): Documents subject to the FBI's CJIS Security Policy (such as, arrest records, criminal history, RMS exports) should not be published to publicly accessible URLs. DocAccess does not maintain CJIS compliance and is not designed to handle CJI. If your workflow produces PDFs containing CJI, redact regulated content before publishing or exclude those documents from public web locations.

• HIPAA / Protected Health Information (PHI): DocAccess is not designed as a HIPAA-covered service and does not execute Business Associate Agreements (BAAs). Documents containing PHI should not be submitted to DocAccess without appropriate redaction.

• Other regulated data (PII/PCI): The same principle applies. If your organization has published a document to a public URL, that is your disclosure decision. If you need to process documents containing regulated data that are not publicly available, contact us to discuss contractual and technical controls.

We are actively exploring solutions for processing private and internal documents with appropriate security controls.

Data is encrypted at rest with AES-256 and in transit with TLS 1.2+.

Access is restricted using role-based access control (RBAC) and MFA. Operational access is limited to authorized personnel under least-privilege. No third parties access your data except vetted infrastructure providers under a data processing agreement (DPA).

Only at your written request (such as, export/migration) or to meet legal obligations. We do not share data with third parties beyond vetted infrastructure providers under a data processing agreement (DPA).

We retain customer content only as long as needed to deliver the service.

When a document is disabled or deleted mid-contract:

• The viewer and transcription for that document are disabled immediately and no longer publicly accessible

• The original document and transcription data are retained so content can be served immediately if you choose to re-enable the document

• If you want the original document and transcription permanently purged, contact us and we will remove it within 30 days of your request

Upon contract termination:

• The DocAccess viewer and transcriptions are disabled immediately

• Your document control center metadata remains accessible

• Customer content (documents, transcriptions, and associated data) is deleted upon request or per contract within 30 days

• Audit and system logs are retained for 12 months for security and compliance purposes, then deleted

All customer data is backed up automatically with continuous point-in-time recovery. Backups are retained for 14 days and encrypted at rest. Document storage uses versioning to protect against accidental deletion or corruption.

Our infrastructure runs across multiple availability zones with automated failover.

Recovery objectives:

• Recovery Time Objective (RTO): 4 hours

• Recovery Point Objective (RPO): 5 minutes

Yes, we support Azure AD (SAML 2.0 / OIDC) and other standards-based identity providers.

Minimum 8 characters. Passwords are hashed with bcrypt.

MFA is required for privileged/administrative roles and supported for all users.

HTTPS-only, scoped API keys, rate limiting, audit logging, and optional IP allow-listing.

Yes, our security program aligns with NIST CSF and ISO 27001 control families, covering access control, vulnerability management, change control, backup/DR, and incident response.

SOC 2 Type I: Yes. DocAccess has successfully completed a SOC 2 Type I examination, performed by an independent service auditor in accordance with AICPA attestation standards. The auditor issued an unqualified ("clean") opinion on the design of our controls as of May 31, 2026, covering the Security and Confidentiality Trust Services Criteria. SOC 2 reports are restricted-use documents; customers and prospective customers can request a copy of the full report under NDA at support@docaccess.com.

We do not hold ISO 27001 certification, though our security program aligns with its control families.

We evaluate infrastructure and cloud providers against SOC 2 Type II or equivalent standards.

Yes. Reach us at support@docaccess.com.

Yes. We use centralized logging/alerting, triage/escalation, and containment/eradication/recovery playbooks. If a breach affecting your data is confirmed, we notify you within 72 hours.

DocAccess is establishing an annual third-party penetration testing program, with additional risk-based assessments following significant architectural changes. Once completed, an executive summary of results will be available to customers under NDA upon request.

We evaluate vendors against SOC 2 Type II or equivalent standards where applicable. Vendors are reviewed annually for security and contractual compliance.

Yes, separate staging and production environments with approvals and automated testing.

Yes. We maintain a Vulnerability Disclosure Policy (VDP) and accept good-faith security reports at support@docaccess.com. We also publish an RFC 9116-compliant security.txt.

We do not operate a formal bug bounty program at this time, but we are open to compensating (and have compensated) external parties for extraordinary contributions to DocAccess.

What to include in a report:

• A description of the vulnerability

• Steps to reproduce the issue

• The potential impact, if known

Disclosure process:

• We acknowledge receipt within 5 business days

• We provide an initial assessment within 10 business days

• We aim to remediate confirmed vulnerabilities within 30 days of validation, depending on severity and complexity

Coordinated disclosure: We ask that reporters give us reasonable time to investigate and address the issue before any public disclosure. We consider 90 days from acknowledgment to be a reasonable disclosure timeline.

Scope: This policy applies to the DocAccess application and its associated services. Third-party services, dependencies, and infrastructure providers are out of scope.

Good faith: We will not pursue legal action against individuals who report vulnerabilities in good faith and in compliance with this policy. Good faith means:

• You do not access or modify data belonging to other users

• You do not degrade the availability of our services

• You stop testing once you have confirmed the vulnerability

• You do not publicly disclose the vulnerability before we have had reasonable time to address it

Our document conversion pipeline uses OpenAI GPT-4o, GPT-4.1, GPT-5, GPT-5.1, GPT-5.4, and GPT-5-mini. AI is used for OCR post-processing, document structure reconstruction, alt-text generation, document Q&A, and multi-language translation.

No. Customer data is not used to train shared models. Processing is request-scoped.

Strict context isolation, input/output validation, content filtering, least-privilege tool access, and policy enforcement.

Multi-stage OCR with language detection, AI-assisted reconstruction, automated checks with accessibility validators (such as, Lighthouse/axe-core), and feedback loops. Human review tools are available for customers.

We can fail over to alternate LLM providers and gracefully degrade to non-AI rendering where applicable.

Generally, no, outside of a limited graph during document processing. Outputs are assistive content; humans remain in the loop. User actions are audit-logged.

Standardized preprocessing and deterministic prompting reduce variance. Models are validated on diverse document types common to public sector use.

Daily patches, weekly feature updates, and weekly functional releases. Critical security patches are prioritized and deployed as quickly as possible.

Yes, system and audit logs are retained for 12 months.

We collect only aggregated, de-identified data to help you understand document usage.

What we collect:

• Document ID/Name

• Timestamp of view

• High-level geography only (such as city or county/region)

• Device type or browser type (optional, not PII)

• Count of views (aggregate)

What we never collect or store:

• Exact IP addresses (considered personal information under CCPA/GDPR)

• User account IDs or emails when viewing documents

• Precise location tracking (GPS or detailed IP geolocation beyond city)

• Cross-site tracking or behavioral profiling

Infrastructure-level data collection:

Some components of our infrastructure (such as CDN and load balancers) do collect system-level information, including IP addresses for security monitoring, DDOS protection, and performance optimization. This data is isolated to those infrastructure components and is not integrated with our application-level analytics or customer data systems.

• DocAccess: Platform security, availability, and processing pipeline.

• Customer: Review of outputs, enabling/publishing the accessible versions, and managing user access.

Autoscaling supports thousands of concurrent users and batch jobs.

The web application supports Chrome, Edge, Firefox, Safari, and all other modern standards-compliant browsers. The API is HTTP-based and client-agnostic.

Annual subscription based on page volume tiers. A usage dashboard provides thresholds and alerting.

We can provide you with an export of your document control center (including metadata, accessibility reports, and full URLs) even if you end your service. Aside from transcripts downloaded while in a multi-year plan (which can include rights to downloaded transcripts), we do not offer a license to publicly host transcriptions or use the DocAccess viewer service without a paid plan, as we are not able to provide the necessary assurances, such as live assistance, to ensure an accessible experience, and continue updating to meet the latest standards.

We have a history of supporting organizations that encounter financial difficulty to keep their service running, so please reach out if needed.