Security
Security — how a document is actually protected
How does docivault keep documents secure?
The problem
Most document sharing has no access control after you hit send
An email attachment can be forwarded by anyone who receives it. A 'share this link' from a general-purpose drive often means anyone holding the link, forever, with no record of who actually opened it. Inside a docivault workspace it works the other way: access is checked on every request, not once at send time, and nobody receives the file itself.
A link outlives the reason you sent it
A public share link usually keeps working long after the exchange it was made for is over, because nothing expires it and nothing checks who is using it.
Forwarding is invisible
Once a file or a link leaves your hands over email or chat, there is no way to know who it ends up with next, or to cut off access after the fact.
One missed check is the whole gap
If the only thing standing between a request and a private file is a check inside one page or API route, a single missed check in a single code path is the whole gap. docivault sends every document request through one shared access rule, with row-level security behind it.
Storage
Nobody is handed the file — only one page at a time
This is the path a document takes when someone opens it. Every step below is running in production.
1. Your browser asks the app for a page of the document
The request reaches the app, running on Vercel in Mumbai, over an encrypted connection.
2. The app checks you may see it, with row-level security behind it
One shared rule in the app checks your identity, your role and, for team members, which contacts you are assigned to, before any file is touched. Database row-level security stops a query from reaching another workspace’s rows. If the answer is no, the app replies “not found”, so it does not confirm the document exists.
3. If allowed, the app reads the encrypted page from Cloudflare R2
When a file is uploaded, docivault’s own converter, running on Google Cloud in Mumbai, scans it and turns it into page images, and what is kept is encrypted. The bucket is private. There is no public URL for it, or for any file in it, and your browser never receives a storage link.
4. The app decrypts one page
Decryption happens on the server, for that single page only, after the access check has passed on that request.
5. Your browser receives a plain page image
Viewing never hands over the file, and the access check runs again the next time you ask for a page. Downloading is a separate permission an admin grants per document, it is logged, and share-link visitors can never download. Screenshots and photos of a screen cannot be prevented by any web product; turning download off removes the file, not the ability to photograph a screen.
Access control
What you see depends on who you are, enforced on every request
The same workspace looks different depending on your role, and that difference is not just a hidden menu item — it is what the server will and will not return.
- Admins see the whole workspace: every member, every contact, every document.
- Members see only the contacts they are assigned to, and only the documents that belong to those contacts.
- External contacts — the people you exchange documents with — see only their own space, never anyone else's.
Sign-in
Getting in is harder to get wrong than typing a password
Two-factor authentication
Available nowTime-based codes from any authenticator app, with backup codes. An admin can require it for the whole workspace.
Passkeys and biometric sign-in
Available nowSign in with Face ID, Touch ID or a hardware key instead of typing a password.
Idle sign-out
Available nowAn unattended session warns, then signs itself out, and every open tab follows.
Sign-in abuse protection
In progressRate limiting is live on every sign-in route. Owner notification on repeated failures is being added.
Not built yet
A complete audit trail is not here today
This page only states what is running in production. Each document open, by a contact in their portal, a team member or someone using a share link, is recorded, and so is workspace activity. What is not built is any screen to browse those records, any export, or a complete, tamper-proof audit trail.
Looking for the compliance position, or where your data is actually stored?
Read the compliance roadmapFor the full list of vendors that touch your data and the region each one runs in, see subprocessors.
Report a vulnerability
Found a way in? Tell us before someone else does
There is no bug bounty program and we will not promise a response time we have not earned. What we can tell you is that a report to this address is read and answered by a person, not a ticketing queue.
Email security@docivault.com directly, with as much detail as you can about how to reproduce it. Please give us a reasonable window to fix an issue before disclosing it publicly.
Questions
Security questions, answered directly
Can someone download a document from docivault?
Only if a workspace admin allows it. Download is a per-document setting: admins can always download a document as the original file or a PDF, and team members, client contacts or named people can only when an admin turns it on for that document. Every download is logged. People who cannot download, and everyone who opens a share link, see the document in the viewer: uploads are converted on docivault’s own servers into page images, and what a viewer receives is one plain page image at a time. Share-link visitors can never download. Screenshots cannot be prevented by any web product: turning download off removes the file, not the ability to photograph a screen.
What about sharing a document by link?
Sharing by link is a separate area of the product and this page makes no claims about it. What this page describes is how documents open inside a workspace and a contact’s portal, where every request needs a signed-in person. A visit to a share link is recorded as an anonymous view tied to the link, as described below.
What does "row-level security" mean in practice?
Postgres enforces row-level policies on workspace data, so a query from one workspace cannot return another workspace’s rows. Which documents a team member may open — the contacts they are assigned to — cannot be written as a database policy, so that check lives in one shared rule in the application that every document request goes through. The two work together; neither is described here as the only line of defence.
Is there a record of who opened a document?
Yes, but not enough to call it an audit trail. Each time a document is opened for viewing, by a contact in their portal, by a team member or through a share link, docivault records the document, the time and who opened it (a share-link visit is anonymous and tied to the link). A workspace activity feed records actions across the workspace. What does not exist is any screen to browse those records, any export of them, or a complete, tamper-proof log. If your requirement is a provable access record for every reader, docivault does not meet it today.
How do I report a security issue?
Email security@docivault.com directly. There is no form and no bounty program — a plain report to a real inbox that a person reads.
See the access model for yourself
Create a workspace and add a contact. You will see exactly what they see, because that is what the database, not a settings toggle, decides.
- No credit card
- Free plan, no expiry
- The people you exchange with are free