Security
Security practices
Procurement data is commercially sensitive. Here is how we protect it.
Infrastructure
- Self-hosted on a Contabo VPS in the EU (France) — no hyperscaler (no AWS, GCP, or Azure)
- All services run inside Docker containers with no public-facing ports except HTTPS (443)
- Private internal network for all service-to-service communication
- Automated nightly backups — PostgreSQL schema + file storage — 30-day retention
Encryption
- TLS 1.2+ enforced for all client-to-server and API traffic — TLS 1.0/1.1 disabled
- Tenant isolation enforced in application code on every query; row-level security is a second database-layer check, not the sole safeguard
- Secrets (API keys, database credentials) stored in server-side environment configuration via .env, never committed to source control
Access control
- Role-based access control: Viewer, Editor, Admin — enforced at API level, not just UI
- Tenant isolation: each organisation's data is logically separated by tenant_id on all queries
- JWT-based authentication with expiry and revocation on logout
- Failed login rate limiting: 10 attempts per IP per 60 seconds
Application security
- SQL injection prevented via parameterised queries (PostgREST / Supabase)
- No string-interpolated SQL anywhere in the codebase
- CORS restricted to authorised origins only
- Input validation on all API endpoints via Pydantic models
- AI pipeline rate limiting: 30 requests per tenant per hour
- All user actions logged to a hash-chained, tamper-evident audit log with timestamps
Compliance
- DPDP Act 2023 (India) — data protection and user rights
- GDPR Art. 17 right to erasure — account deletion anonymises PII without breaking audit trail
- GDPR Art. 20 data portability — users can export their data
- HIPAA-aligned controls for medical procurement vertical (no BAA yet — contact us)
- SOC 2 Type II and ISO 27001 — on our compliance roadmap; no formal assessment engaged yet
Auditor-defensible by design
AI reads and extracts the document — the qualification decision itself does not come from a model's judgment call. Once data is extracted, scoring against a published framework version runs on fixed rules: a numeric threshold, a required certification, a controlled-vocabulary match. The same inputs produce the same verdict every time, and a qualification snapshot freezes the template version, the rules, and the evidence at the moment the decision was made — so when an auditor asks why a supplier qualified, the answer is a specific rule and a specific document, not “the AI said so.”
Where AI is genuinely doing judgment work — flagging a low-confidence extraction, drafting a first-pass comparison — a human reviews it before it affects a result, and every AI call is logged with cost and model attribution.
Responsible disclosure
If you discover a security vulnerability in DocIQ, please report it privately before public disclosure. We take all reports seriously and will respond within 48 hours.
Email: hello@dociq.ai.in with subject line [SECURITY]
Please allow us 30 days to investigate and remediate before any public disclosure. We do not have a bug bounty programme at this time.