DOCSUPRA › Enterprise Compliance Studio

The Enterprise Compliance Studio, explained: from a folder of phone photos to a filing-ready ZIP.

Most document platforms want the documents on their servers first and the compliance report second. This one is built the other way round: the audit happens where the file already is, and what leaves the building is a record of hashes and verdicts, never the images.

What the desk is

DOCSUPRA is one piece of software with three studios. The Compliance Studio repairs and exports one document at a time. The Integrity Scanner reads what a file says about its own history. The Enterprise Compliance Studio is the third: a desk for teams that receive documents in volume, organised by department and destination, with the team console inside it. It opens at docsupra.com/#pro for Professional Team and Corporate Studio.

Everything runs in the browser using the machine’s own processor and memory. There is no upload endpoint in the product. Your IT lead can confirm it in two minutes: process a real document with the network monitor open, watch the upload counter stay at zero, then disconnect and watch it keep working.

How a batch goes through, step by step

1. Set the desk up for the department

   Choose the department and the destination. There are 28 destination presets, each with the date it was verified against the official portal and the source; delivery format, dimensions and DPI can be overridden when a portal asks for something specific.

2. Add the documents

   Drag and drop, Upload, Folder or a ZIP: JPEG, PNG, HEIC, TIFF and PDF, up to 500 files per run and 30 MB per file inside a ZIP. Or send the client a capture link and let their phone do the photographing.

3. Read the audit

   Every file is measured against the destination’s rule: format, pixels, DPI, file size, sharpness and orientation, plus an integrity signal from the file’s own metadata. Each row says what passes, what needs a look and what is missing.

4. Fix and export

   One ZIP with every fixed file, an audit CSV and certificate.pdf: per file, the SHA-256 of what was delivered, what was fixed on export and, for anything that cannot comply, exactly what is missing to comply with that destination.

5. Record the batch

   The batch can be recorded to the organisation log: file names, hashes, sizes and verdicts, never the images. Under compliance mode the record is mandatory and pseudonymous, and each record is chained to the previous one by hash so the log cannot be edited without breaking the chain.

6. Run the team from the desk

   The team console lives inside the Enterprise Studio: people and seats, single sign-on, usage per person and department, the organisation log, compliance mode, API keys and webhooks.

The ten modules on the desk

Compliance mode: HIPAA, GLBA, GDPR or your own policy

Compliance mode is a set of rules your organisation enforces on every Enterprise Compliance Studio desk. Nothing in it uploads a document. The rules govern what is recorded about each batch (identifiers, hashes, verdicts), for how long, and how an unattended desk behaves: whether recording a batch is mandatory before the export is released, the retention window for records, whether records carry pseudonyms instead of file names (the GDPR setting), whether a file name that looks like an identifier gets a warning, and whether the desk clears itself when left alone.

The organisation log is chained: every record carries the hash of the previous one, and the console can verify the whole chain at any time. Policy changes, purges, key and webhook changes are recorded in the same log, so the trail of administration is part of the evidence. An evidence PDF summarises the policy in force and the state of the log for an auditor.

What it is not. Compliance mode does not make an organisation compliant by itself, and we do not sell a certification. It gives your programme the two things reviewers ask for first: a written policy that the software actually enforces, and a log that cannot be edited without breaking its chain.

Machine-to-machine access without touching a document

Your case-management, CRM or SIEM system can read the organisation without ever seeing a file. An API key reads the organisation log, verifies the chain, reads usage and policy and creates capture links; it cannot download and it cannot administer. Signed webhooks push three events, batch recorded, batch delivered and admin action, with an HMAC-SHA256 signature you verify on your side. If you build software, the Integrity SDK runs the same file-integrity analysis inside your own application. The developer guide has every endpoint and the signature check.

Where the documents go

Nowhere. The file that entered the desk stays on that machine; the ZIP that leaves it goes wherever your team sends it. What the licence server ever sees is a count of downloads, the hashes and verdicts your people chose to record, and the identifiers of who did it. There is no data-processing relationship to describe for documents, no retention schedule to agree for them, and no supplier breach that becomes your notification letter. The privacy review for IT spells it out step by step, and the trust center carries the DPA, SLA, sub-processor list and enterprise agreement.

Questions

More for teams

Made and copyrighted © 2026 by Soelys Muñoz. DocVerifyPro™ is her trademark. All rights reserved. How to recognise the real site.