DocVaultTrust isn't a feature.
It's every layer.
Security in DocVault isn't confined to one settings page. It's checked at sign-in, at every permission, every search result, every share, every signature and every audit entry.
Your infrastructure, your keys
DocVault installs on servers you control, in your data centre or your own cloud account. Documents, the database and the audit log all stay there, under your backups and your own network rules.
Each workspace is separated twice: by the application, and by PostgreSQL row-level security, on by default.
individual rights in a custom permission set, alongside the four standard levels.
Search can't leak
Live, full-text, tag and metadata search all go through a single access check. If you can't open a file, it doesn't appear in your results, not even its name.
Know exactly who's there.
Two-factor sign-in
Authenticator-app codes, 10 single-use recovery codes, and protection against code reuse. You can move to a new device, and every change triggers a security email.
Confirm before sensitive actions
Sensitive actions ask for your password and a fresh 2FA code again. The confirmation lasts 10 minutes, and API keys can never use it.
One session per person
A new sign-in ends the previous one. Idle sessions get a warning before they close. Disabling a user ends their session immediately.
Accountable admin resets
An admin who resets someone's 2FA must confirm their own identity again and give a reason. The reset is recorded in the audit log and the user gets an email.
IP allow-lists & throttling
Restrict a workspace to approved IP ranges. Sign-in attempts and API calls are rate-limited, and the limits can't be dodged with spoofed headers.
Your password rules
Each workspace sets minimum length, required character types, how many wrong passwords lock an account and for how long, and how often passwords expire. An expired password is replaced at the next sign-in, after 2FA.
Lockouts that reveal nothing
A locked account answers exactly like a wrong password, so sign-in can't be used to discover accounts. The owner is emailed the unlock time, and a password reset lifts the lock at once.
Idle sign-out
Idle sessions are warned, then signed out, after the time your workspace sets, across every open tab.
Directory sign-in
Users sign in with their LDAP / Active Directory password, which DocVault checks against the directory and never stores. 2FA still applies.
Protection that travels
with the file.
Sharing limits
No one can share a file at a higher level than they hold. Shares can expire, public links can carry a password and a download limit, and every grant appears in Shared by me and in the admin's Access overview, where it can be removed in bulk.
True redaction
Burning in a redaction creates a new version in which the redacted pages are flattened to images, so the text under the black box is gone, not hidden. Signed documents and files on legal hold can't be redacted.
Watermarks in the file itself
When signed-in users preview or download, the file is stamped with their name, email and date. The stamp is built into PDFs, images, Word, Excel and text files, not just drawn over them on screen.
A strict upload gate
The server checks each file's real type. Executables, scripts, active HTML/SVG and macro-enabled Office documents are always refused. ZIP imports are protected against malicious archive paths.
Locks and legal holds
A check-out lock stops everyone except the person holding it. A legal hold freezes the file for everyone: no deletion, retention, erasure, signing or masking until it's released, with a recorded reason.
Tamper-evident signatures
Signed documents carry a reference on every page and come with an audit-trail certificate. An optional PAdES platform seal makes any later edit detectable in standard PDF readers.
A history
built to be trusted.
Each audit entry records what changed, from what, to what, by whom, and when. Entries are written one at a time per workspace, and each carries the hash of the entry before it.
- Old ā new values across permissions, metadata, settings and more.
- Exports match the screen: CSV and XLSX use exactly the filters you set, with timestamps in UTC.
- Failures are visible: if recording ever fails, a health banner appears for admins.
What we provide,
and what your team runs.
Because DocVault runs on your infrastructure, a few protections are set up by your IT team. We'll help, and we'd rather you hear about them now than discover them later.
| Area | DocVault provides | Your infrastructure team |
|---|---|---|
| Encryption in transit | Works behind any standard reverse proxy | Terminate HTTPS at the proxy with your certificate (required before internet exposure) |
| Backups | Database and storage backup & restore scripts | Schedule them and copy backups off the server |
| Signature seal identity | PAdES seal on signed documents | Provide a certificate from a recognised CA for production |
| Malware scanning | Executables, scripts and macro documents are blocked | Antivirus scanning is on our roadmap. Use your existing scanning in the meantime |
| Single sign-on | Built-in 2FA and LDAP / Active Directory | SAML / OIDC is on our roadmap |
| Availability | Single-server deployment with monitoring | Host sizing and snapshots. Multi-server high availability is on our roadmap |
DocVault supports your security and compliance programme. It doesn't on its own certify an organisation against any standard.
Bring your
security questionnaire.
We'll go through it line by line with your security team.