Security & Verification
File verification checks whether a copy matches its recorded fingerprint and gives your team a traceable record for review.
Protecting access to your record
Understand how DocuProof protects connections and supports authenticated access, and what your firm should review before submitting confidential material.
HTTPS / Encryption in transit
DocuProof uses HTTPS for its production web service. HTTPS uses TLS to encrypt traffic between your browser and the service, helping prevent interception and tampering in transit.
This protects the connection; file integrity verification separately checks whether a file matches its recorded version.
JSON Web Tokens / Session protection
Token-based authentication, including JSON Web Tokens (JWTs), lets the service recognize authenticated requests. A signed JWT can be checked for tampering; signing is not encryption of the token’s contents.
The frontend’s session cookies use Secure, HttpOnly, and SameSite settings to help protect cookie-based sessions. Some integration flows also use browser-stored tokens, so these cookie protections do not cover every token used by the application.
Passkeys / Phishing-resistant sign-in
DocuProof supports passkey sign-in through WebAuthn. Passkeys use public-key cryptography and are bound to the service’s domain, helping prevent a lookalike website from stealing a credential it can reuse to sign in.
A fingerprint, face scan, or device PIN can unlock your passkey locally. Your biometric data is not sent to DocuProof as part of the passkey sign-in.
Passkeys / Multi-factor authentication
When biometric or PIN verification is required and checked, a passkey combines possession of the credential with something you are (a biometric) or something you know (a PIN). That can provide multi-factor authentication without a separate SMS code.
A touch-only security-key interaction is not the same as verified biometric or PIN use. MFA assurance depends on the authenticator and the sign-in policy; device security and account recovery remain important.
Data residency / Canada
DocuProof uses Canada for its core application hosting and primary application storage. Files in your connected cloud accounts remain subject to your provider’s storage settings and agreements.
Regional hosting does not mean every service processes all data within that country. AI, authentication, communications, billing, and other supporting providers may process information in other jurisdictions.
For a country-only processing requirement, confirm the eligible features and contractual scope with us before submitting records.
Read the data residency policySOC 2 readiness
SOC 2 readiness involves documenting controls and preparing evidence for an independent examination. Relevant areas include access management, security monitoring, change management, incident response, and vendor oversight.
Our Data Processing Addendum describes the service’s security measures. These measures can support your firm’s due diligence; this page does not assert a completed SOC 2 readiness assessment or a SOC 2 Type I or Type II report.
Ask about current assurance documentation or learn about SOC reports from AICPA.
Your files stay with you
Use the storage your firm already has. Originals remain in your provider account; DocuProof can read connected files and create processing copies.
Selected files flow from your drive to DocuProof for text extraction, verification and report generation. Processing copies, extracted text and verification records are kept in our application systems. DocuProof hosts its core application and primary application storage in Canada.
When you use AI features, relevant content is sent to AI providers for analysis and may be processed outside the application’s hosting country. Other supporting services may also involve cross-border processing. Country-only processing requires written confirmation for the specific features and service scope.
Privacy policy · Data Processing Addendum
The record behind the file
Certified evidence pairs a file with a record of its verification. A digital fingerprint identifies the recorded version, so a later copy can be checked for changes. The certificate brings together the verification details, with timestamps and recorded handling history where available.
File integrity
Compare a file with its recorded fingerprint to check whether it matches that version.
Trusted timestamps
An available trusted timestamp dates the verification record.
Recorded handling history
History covers captured application events.
Storage, access and processing
Know what is read, shared and retained before connecting confidential material.
01 / Read and record
Connected features can store file copies, extracted text, file details, activity history and verification records. Disconnecting a drive does not delete those existing copies or records.
02 / AI processing
AI 360 Review sends supplied text and file details to AI. Other AI tools may also send files or extracts.
03 / Retention and access
Request matter deletion at any time. Our policy commits to removal from active systems within 30 days of a verified request, with backups expiring within a further 90 days. Limited legal preservation exceptions apply. Your cloud originals and downloaded packages remain under your control.
The Data Processing Addendum describes role-based and least-privilege access. Infrastructure, AI, support and security providers may process data to deliver the service.
Your client records. Your firm reviews. One connected case record.