Every flow,
step by step.

01

Upload

From the moment you drop a file to the moment it's searchable.

ResumableSHA-256Type checkQuota check

1. You choose a folder and drop filesSingle files, many files or whole folder trees. If the folder has a metadata template, you fill in the fields as you upload. Required fields must be filled before the upload can start.
2. Small files go in one requestFiles up to 10 MB are sent in one go. The server checks your permission, the storage quota, and the file's real type by reading its content.
3. Large files go in partsBigger files are split into 10 MB parts, four uploading at a time straight to storage, each retried automatically. If the connection drops or the page reloads, choosing the file again resumes the upload where it stopped.
4. The server assembles and fingerprints itDocVault checks the type again from the assembled file, computes its SHA-256 fingerprint, and stores it under a server-chosen name.
5. One finishing step for every route inBrowser uploads, resumable uploads and ZIP imports all finish the same way: version recorded, metadata saved, template attached, document number issued, retention policy inherited from the folder, tags applied, and the upload written to the audit log. If any part fails, the whole upload is rolled back.
6. Everything downstream reactsOnce the upload is saved, workflows can start, watchers are notified, webhooks fire, optional Aadhaar masking runs, and the file is queued for text indexing.

Good to know

• A file with the same name is saved as "name (2)". Adding a new version is a separate, deliberate action.
• Executables, scripts, active HTML/SVG and macro-enabled Office files are always refused.
• Default limits are 250 MB per document and 2 GB per media file, and admins can change them. ZIP imports can hold up to 500 MB and 500 files.

02

Preview

Opening a 500-page PDF without waiting for all of it to download.

Range requestsOffice → PDFWatermark

1. You open a fileThe viewer asks the server for the file and renders the first two pages.
2. Only the pages you need are fetchedThe server supports byte-range requests, so the viewer fetches the file in small chunks and renders more pages as you scroll.
3. Office files are converted onceWord, Excel and PowerPoint files are converted to PDF on the server the first time they're opened, then served from that copy afterwards.
4. Watermarks are stamped inIf your access level calls for a watermark, the server stamps your name, email and date into the copy you see or download. The browser overlay is only a fallback for formats that can't be stamped.
5. Every view is loggedPreviews and downloads are recorded separately in the audit log. Download links are single-use and expire after 60 seconds.

Good to know

• Office previews are an optional module. Without it, Office files are downloaded instead.
• The PDF viewer is bundled with DocVault and needs no internet access.

03

Indexing & search

How a scanned page in Tamil becomes a search result, but only for people allowed to see it.

TikaTesseractPostgreSQL FTSAccess filter

1. A background indexer picks up new versionsIt runs every minute, taking new versions in turn.
2. Text is extractedWord, Excel, PDF, text and similar files have their text read directly. A PDF with no text layer is treated as a scan.
3. Scans go through OCRImages and scanned PDFs are rendered page by page and read by Tesseract in the folder's language. If that language isn't available, it falls back to English.
4. The text is indexed in PostgreSQLSearch uses PostgreSQL's own full-text index, so there's no separate search cluster to run or secure.
5. You searchLive search matches names and document numbers as you type. Deep search also searches inside the text, with phrases, OR and exclusions. An exact document number always ranks first.
6. Results are filtered by permissionEvery candidate result is checked against your actual access before it's shown. Search has no access rules of its own; it uses the same checks as the rest of DocVault.

Good to know

• OCR reads the first 20 pages of each scanned PDF. Files over 50 MB aren't text-indexed.
• Indexing runs in the background, so a new scan is searchable a little while after upload.
• Metadata search allows up to 20 conditions. Personal-data fields only allow exact matches.

04

Sharing

Giving access, limiting it, and taking it back.

Grant ceilingExpiryApproval gate

1. You choose people or groupsPick a level: Previewer (view only, no download), Viewer, Editor or Custom. Optionally include sub-folders, an expiry date and a note.
2. DocVault enforces the ceilingYou can only share at your own level or below, and for Custom, only rights you hold yourself. Disabled or deleted accounts can't receive shares.
3. An approval gate, if your process needs oneIf a workflow holds new shares for approval, the share stays inactive and no one is notified until it's approved.
4. Recipients are toldRecipients get an in-app notification and an email. Webhooks and watchers react too.
5. Access expires when you said it wouldExpired shares are removed automatically every hour.
6. You review and revokeShared by me lists every share and link with its current status, and admins see every grant per person in Access overview.

Good to know

• Public links can have a password, expiry date and download limit, and are checked on every request. Folder links only allow browsing inside that folder.

05

Workflows

How a drawn process runs by itself.

8 triggersConditionsLocksSLA

1. Something happensA file is created or gets a new version, a metadata value changes, a share is added or removed, a tag is added, a file moves, or another workflow finishes.
2. Matching workflows startEach enabled workflow checks its trigger and scope (folders, depth, name pattern). Chained workflows are limited so they can't loop.
3. Steps run in orderConditions branch the flow. Delays wait. Actions move, copy, tag, set metadata, notify, set retention, apply a legal hold or redact Aadhaar numbers.
4. People are asked to decideApproval, review, acknowledgement or signature, in parallel, in series, or in a custom order. The file is locked while the decision is pending.
5. Deadlines are watchedIf a due date is missed, the initiator is alerted. If an approval times out, it counts as rejected.
6. The outcome continues the flowApproved and rejected each follow their own branch. A summary PDF is produced, the file can be moved, and the lock is released.

Good to know

• Deputies and delegates can act for someone, under their own name.
• There is one pending decision per file at a time.

06

Signing

What happens between "please sign" and a verifiable signed PDF.

Envelope IDAudit certificatePAdES

1. A signing copy is preparedSigning works on a PDF. Office documents are converted to PDF first.
2. Each signer signsDraw, type or use a saved signature in the marked positions. Signers go in parallel or in series.
3. The signature is stampedYour signature image, name, email, time and organisation logo are placed on the page, and the envelope reference is printed down the margin of every page.
4. A new version is savedThe signed PDF becomes the current version. A separate audit-trail certificate is created, recording signer IP, method, timestamps and SHA-256 hash, with an IT Act §5 statement.
5. The final copy is sealedAfter the last signer, an optional PAdES platform seal makes later edits detectable.
6. Anyone can verifyA public page confirms the document by its reference, or by uploading the file and matching its hash.

Good to know

• DSC signing uses .pfx certificate files and embeds a real PAdES signature. Hardware tokens aren't supported yet.
• Aadhaar eSign is available only as a test sandbox today, and its signatures are clearly marked as not legally valid.

07

eForms

A public form that files itself.

Server validationNumberedWorkflow

1. An admin designs and publishesFields, uploads, a signature pad, an expiry date and a submission limit.
2. Someone fills it inThe public form shows only published forms that are still open.
3. The server re-checks everythingEvery rule is checked again on the server, uploads are size-checked, and the submission limit can't be exceeded even when people submit at the same moment.
4. The submission becomes a documentA PDF is created in the target folder, attachments become linked documents, and the submission's reference is recorded.
5. Numbered and routedIt can get a number from the form's numbering scheme and start the form's workflow.

Good to know

• Up to 10 MB per attachment and 40 MB per submission.
• Submissions are never refused because storage is full. Admins are warned instead.

08

Numbering

Why two documents can never get the same number.

Unique registerIST

1. The nearest scheme appliesEach folder can have one scheme, which its sub-folders inherit.
2. The pattern is builtDate, time, year, month, day, folder, metadata values and a zero-padded sequence.
3. The next number is reservedThe counter is reserved in a single database operation, and resets daily, monthly, quarterly or yearly on India time if you choose.
4. The register makes it uniqueEvery number is written to a register that can't hold duplicates. If a clash ever happens, the document is left unnumbered rather than duplicated, and admins are told.

Good to know

• Manual overrides are admin-only, go through the same register, and are audited.
• Existing documents can be numbered in bulk, oldest first.

09

Retention, legal hold & recycle bin

How a document leaves on schedule, unless the law says it stays.

Legal hold30-day bin

1. A policy is attachedInherited from the folder at upload, set by a workflow, or applied by an admin.
2. Owners are warned90, 30 and 7 days before expiry.
3. The daily run actsArchive, move to the recycle bin, or delete permanently, all recorded in the audit log.
4. Holds and locks always winFiles under legal hold or locked are skipped, and checked again on the next run.
5. The recycle bin is the safety netDeleted items can be restored for 30 days, with a name-conflict check, and are then cleared automatically.

Good to know

• A legal hold also blocks deletion, moving, DPDP erasure, masking and burning in redactions.

10

DPDP requests & breaches

From a data principal's request to a closed case.

Configurable SLAReviewed erasure6-hour clock

1. A request arrivesThrough the public form: access, correction, erasure or nomination. It reaches your admins only after the requester confirms it from a one-time link emailed to them (valid 48 hours). Unconfirmed requests are closed automatically.
2. The clock startsEach workspace sets its own response periods. The defaults are 30 days for data requests and 90 days for grievances.
3. Admins assign and actEach request is assigned, completed or rejected, with every step recorded in the audit log. Before completing an access or erasure request, the admin records how the requester's identity was confirmed.
4. Erasure respects legal holdNothing is deleted automatically. The admin opens "Find this person's data", sees what the workspace holds and why each item matched, and selects what to erase. Selected files go to the recycle bin and are permanently deleted after 30 days. Files on a live legal hold are kept, and that is recorded with the request.
5. Breaches run on the CERT-In clockEach incident gets a reference. Admins are reminded 2, 4 and 5 hours after detection, a pre-filled CERT-In report PDF is ready to download for you to submit yourself, and the case is closed with the CERT-In reference.

Good to know

• These tools support your compliance process. Have your legal team confirm how you use them.

11

Sign-in & sessions

Who gets in, and how quickly access ends.

2FASingle sessionLDAP

1. Password checkA local password, or your directory password through LDAP. Five failed attempts lock the account for 15 minutes.
2. Second factorAn authenticator code or a one-time recovery code. Codes can't be reused. If 2FA is mandatory for your workspace, setting it up is the only thing a new user can do.
3. A session is issuedOnly one at a time: signing in again ends the previous session.
4. Every request is re-checkedYour current role and account status are read on every request, so disabling a person or suspending a workspace takes effect immediately, and the next screen says why.

Good to know

• Invitations expire after 72 hours and password-reset links after 24 hours.
• API and sign-in rate limits protect against abuse.

12

Notifications

The right people hear about it, at the pace they chose.

DigestsOutboxPause switch

1. Something changesA new file, a new version, a share, a tag, a finished workflow, a metadata change.
2. Watchers are checkedDocVault checks that each watcher can still open the item. If not, it stops their watch instead of notifying them.
3. Delivered in-app and by emailInstantly, or grouped into a daily or weekly digest, following each person's preferences.
4. Email is queued and retriedMessages wait in a durable queue and are retried with back-off. The pause switch holds all mail until you resume.

Good to know

• Reminders can be one-off or repeat daily, weekly, monthly or yearly.

13

Workspaces & isolation

Running many organisations on one installation.

Row-level securityStorage poolWhite-label

1. The operator creates a workspaceWith its first admin invite, plan limits and a storage allocation from the shared pool.
2. The workspace makes it its ownIts own logo, colours, login screen, users, groups and settings.
3. The database keeps them apartEach connection is tied to one workspace, and PostgreSQL row-level security only returns that workspace's rows, on top of the application's own checks.
4. Suspension is immediateSuspending a workspace blocks sign-in and ends live sessions.

14

API & webhooks

Connecting your other systems safely.

Bearer keysHMACRetries

1. Create a scoped keyBound to one section or folder, with read, upload, delete-file and create-folder rights. It's shown once and stored only as a hash.
2. Call the APIYour system sends the key as a bearer token. Anything outside the key's scope is refused.
3. Subscribe to eventsFiles, folders, shares and workflows. Each delivery is signed with HMAC-SHA256 using a secret for that webhook.
4. Deliveries are retriedFailures back off and retry up to 8 times. Every attempt is logged and can be retried by hand.

Good to know

• Keys can be rotated or revoked instantly. Revoking also removes the key's folder access.

15

Annotation, redaction & masking

Marking up documents, and permanently removing what shouldn't be there.

True redactionMasking

1. Annotate on a separate layerHighlights, ink, notes, arrows, boxes and redaction marks sit on top of the document without changing it.
2. Burn it inBurning in creates a new version. Pages with redactions are flattened to images, so the text underneath is gone.
3. Optional Aadhaar maskingA separate service finds Aadhaar cards and masks the number and QR code in every version. Files it can't touch (on hold, locked or signed) are listed for review.

Good to know

• Signed documents and files on legal hold can't be redacted or masked.
• Masked files replace the originals, with no unmasked copy kept.

16

Installing DocVault

From an empty server to a running vault.

DockerOne config fileBackups

1. Choose the modulesOne configuration file sets OCR and its languages, Office previews, masking, eSign mode and the seal. A typo stops the build instead of quietly changing what ships.
2. Start itOne command builds and starts PostgreSQL, MinIO storage, Redis, the API and the web app, then waits until DocVault reports healthy.
3. Verify itA verify command checks that the running install matches its configuration.
4. Put it behind HTTPSYour reverse proxy serves DocVault on your domain with your certificate.
5. Back it upScripts dump the database and mirror the file storage. A restore asks for explicit confirmation.

Good to know

• Change every default credential at handover, before the system holds real documents.