Compliance roadmap
Compliance roadmap — what we hold, and what we do not
Is docivault ISO 27001 or SOC 2 certified?
Today
What we hold today is nothing
No certificate. No completed audit. No signed report on file for any framework. A small, self-funded product that claimed otherwise would be lying to the buyers who can least afford to be wrong about it, so this page states the position plainly instead.
Roadmap
Three things an enterprise buyer asks for, and where each stands
No dates are promised anywhere on this page. A status can move from roadmap to in progress to shipped, and when it does, this table is the first place that changes.
ISO 27001 certification
On the roadmapNot held. No audit has been undertaken and no date is promised.
SOC 2
On the roadmapNot held. No audit has been undertaken and no date is promised.
EU data residency
On the roadmapData is stored in India today. Moving it to the EU is a migration, not a setting, and it is not done.
Data Processing Agreement
No signable DPA yet — the current data-processing position is written out in full on its own page.
What we do instead
The controls that exist today, not the badge that doesn't
A certificate describes a process that was audited at a point in time. In its place, here is what actually runs in production, checked on every request rather than once a year.
- Private object storage with no public URL for any file, ever.
- Short-lived signed URLs, generated per request, that expire within minutes.
- Postgres row-level security deciding who can read a row, enforced in the database.
- Authenticator-app two-factor authentication and passkey sign-in.
- Encryption in transit and at rest.
Data location
Where your data actually sits today
The database runs in Supabase's ap-south-1 region, in Mumbai, India. Files are stored in Cloudflare R2. The application itself is served from Vercel, with functions running in US East. EU data residency is planned and is not done — Supabase cannot move an existing project's region, so getting there is a migration, not a configuration change. The subprocessors page lists every vendor and the region each one runs in.
Who this is for
If you need a certificate today, we are not your answer yet
This is deliberate, not an oversight we hope you miss. If your procurement process requires a completed ISO 27001 or SOC 2 audit, or data held in the EU, before a contract can be signed, docivault does not clear that bar right now. We would rather lose that deal today than win it on a claim we cannot back.
Questions
Compliance questions, answered directly
Do you have a target date for ISO 27001 or SOC 2?
No. Both are on the roadmap and neither has a date attached, because we would rather ship nothing than promise a date we might miss. This page will change the day either status changes, and not before.
Can you sign a Data Processing Agreement (DPA) today?
Not yet — a signable DPA is in preparation. The DPA page sets out the current data-processing position in full and who to contact about it in the meantime.
Will you move our data to the EU if we ask?
Not on request. Supabase cannot move an existing project to a new region and R2 jurisdiction is fixed when a bucket is created, so EU residency is a migration project for the whole platform, not a setting for one workspace. It is planned; it is not done.
What should we actually evaluate instead of a certificate?
The controls themselves: private object storage with no public URL, short-lived signed links, Postgres row-level security, two-factor authentication and passkeys. The security page explains each one and how it behaves today, without a badge standing in for it.
Is docivault a fit for a regulated buyer right now?
Only if a certificate or a report is not the deciding factor. If procurement requires one of these on file before a contract can be signed, we are not the right answer for you yet, and we would rather you know that now.
If the fit is right today, start free
No certificate to show you, and no pressure either — try the workspace itself and judge the controls directly.
- No credit card
- Free plan, no expiry
- The people you exchange with are free