Security at DocRelay

DocRelay processes sensitive business documents. Security is designed into how jobs are submitted, processed (including optional human review), and delivered through REST, WebSocket, webhooks, and Zapier.

This page describes intended practices for a product demo site and is not a formal certification or audit report.

Encryption

• TLS for data in transit between clients, our APIs, and delivery endpoints
• Encryption at rest for stored documents and results in our managed infrastructure
• API keys treated as secrets; we recommend rotation and least-privilege scopes

Access control

• Role-based access for workspace users and administrators
• Authentication required for dashboard and API access
• Internal staff access limited to operational need and subject to audit
• Support for enterprise controls (SSO, dedicated environments) on applicable plans

Human review workforce

When a job needs human validation, work is assigned to reviewers who have completed background checks and operate under confidentiality obligations. Reviewers see only the content required for the task, can check in and out of the system as scheduled, and are monitored through platform workflows rather than unrestricted file shares.

Application and API security

• Job-level isolation of customer workloads where architected
• Idempotency keys and request authentication on job creation
• Rate limiting and abuse detection on public endpoints
• Logging of security-relevant events for investigation and support

Infrastructure and operations

• Hosted on reputable cloud providers with network segmentation
• Regular patching of systems and dependencies
• Backups and recovery procedures for service continuity
• Monitoring and alerting for availability and anomalous behavior

Your responsibilities

• Protect account credentials and API keys
• Configure webhooks and Zapier connections to trusted endpoints only
• Avoid uploading data you are not authorized to process
• Promptly report suspected compromise of your workspace

Vulnerability reporting

If you believe you have found a security issue, email [email protected] with “Security” in the subject line. Please include steps to reproduce and avoid accessing data that is not yours. We appreciate responsible disclosure.

Enterprise questionnaires

Security and compliance questionnaires for enterprise evaluations can be requested at the same address. Formal certifications, if any, will be listed here as they become available.