Trust, documented.

Everything a security reviewer, legal team, or enterprise buyer needs about DocuJSON — in one place. If something is missing, email us.

Current Posture

Where we are, right now.

Security

A layered security program covering infrastructure, application code, authentication, data handling, and vendor management.

TLS 1.2+ in transit; AES-256 at rest (provider-managed)
HTML sanitization (DOMPurify) and strict CSP on every rendered template
SHA-256 hashed API keys — raw keys shown once and never stored
Row-Level Security (RLS) enforces tenant isolation
Webhook SSRF protection and Stripe signature verification

Security page

Privacy

Our Privacy Policy covers what we collect, why, who we share it with, and how long we keep it.

We don't sell personal data
We don't train AI models on Customer Content
Customer payload data is processed transiently and not persisted
Data-subject rights workflow drafted; publish after intake is operational

Data Processing Addendum

Available for all paid customers. Standard DPA below. Request a counter-signed copy via email.

GDPR Article 28 / CCPA service provider terms
Standard Contractual Clauses for international transfers
Counter-signed copies available for Business + Enterprise

Read the DPA

Sub-processors

Public list of the third-party services that process your data. 30-day change notification commitment.

Full public registry at /sub-processors
30 days advance notice on any additions
Objection window for Business + Enterprise customers

See sub-processors

Compliance Status

The honest answer — always on this page.

Standard	Status
SOC 2 Type I	Planned / readiness prep
SOC 2 Type II	On roadmap
HIPAA	On roadmap — do not submit PHI
ISO 27001	Evaluating
CCPA / CPRA	Drafted — validation pending
GDPR / UK GDPR / Swiss FADP	Drafted — validation pending
PCI DSS	N/A — Stripe handles card data

What We Don't Do

To save you a question.

We don't sell or share personal data with advertisers or data brokers.

We don't use Customer Content to train generative AI models.

We don't grant employees unrestricted access to production customer data.

We don't claim certifications we have not achieved.

We don't hide pricing behind a “contact sales” form.

We don't auto-enroll you in paid plans without a clear checkout step.

Documentation

All the paperwork, one index.

Document	Purpose	Status
Terms of Service	The agreement governing your use of DocuJSON	In progress
Privacy Policy	What data we collect and how we use it	In progress
Data Processing Addendum	GDPR Article 28 / CCPA service provider terms	Available on request
Acceptable Use Policy	What you can and can't do with DocuJSON	In progress
Cookie Policy	Cookies we use and how to manage them	In progress
Sub-processor List	Third-party services that process your data	In progress
Service Level Agreement	Uptime commitments and service credits	Per plan
Security	Current security posture and roadmap	Live

Security Questionnaires

We're happy to complete CAIQ, SIG Lite, or custom vendor-risk questionnaires for Business and Enterprise customers. Turnaround: 5-10 business days for the first one, faster for updates.

Include in your request