DOCSUPRA › Trust center › Security

Security · reviewed 18 September 2026

Security and architecture, written to be checked.

Every statement here is either verifiable from your own browser or marked as something we do not yet have. Reviewers may copy the questionnaire table into their own template; we will also complete yours on request.

Architecture

DocVerifyPro is a single static web application served from Cloudflare’s edge, plus a small licence API. The imaging engine — perspective, lighting, sharpness, format and size targeting — runs in the browser’s JavaScript and canvas. There is no server component that receives, stores or transforms a document. The licence API answers one question per download (“is this licence allowed to export?”) and receives no file.

Network allow-list (Content Security Policy)

The page declares, in a header your browser enforces, the only hosts it may contact. IT teams can allow exactly these and nothing else:

docsupra.com          the application and its assets
api.docsupra.com      licence checks (JSON only; no file upload endpoint exists)
js.stripe.com, api.stripe.com, checkout.stripe.com, hooks.stripe.com, merchant-ui-api.stripe.com
                          payment form and checkout, only when you open them
static.cloudflareinsights.com, cloudflareinsights.com
                          cookie-free page-view counter (path, country, referrer)

Headers served on every response: Content-Security-Policy, Strict-Transport-Security (preload), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Cross-Origin-Opener-Policy: same-origin, Permissions-Policy (camera only for this origin; geolocation, microphone, USB and others denied), frame-ancestors 'none'.

Identity, seats and access

Team and Studio members sign in with their work email through a one-time link (or single sign-on where configured). Seats are counted per person; an administrator can remove a person at any time from the administration console and their access stops immediately. Individual plans need no account: the licence lives in the browser that paid.

Vulnerability management and responsible disclosure

• Report to security@docsupra.com; machine-readable policy at /.well-known/security.txt.
• Acknowledgement within 2 business days; triage within 5; fix or mitigation for high-severity issues targeted within 30 days, with the reporter informed at each step.
• Safe harbour: good-faith testing that does not access other customers’ data, degrade the service or exfiltrate data will not be pursued.
• The single vendored library (PDF.js) is pinned; updates are reviewed and redeployed under a new file name, so cached copies cannot be stale.

Incident response

1. Detect. Server errors alert the operator by email within minutes (route and stack trace; no customer data). Edge analytics flag traffic anomalies.
2. Contain. Rotate the licence-signing secret and API tokens; revoke affected licences; if needed, take the licence API offline — the application itself keeps working for existing sessions.
3. Assess. Determine which data classes could be affected. Because no document is ever held, the assessable classes are billing records (held by Stripe) and licence data.
4. Notify. Affected customers within 72 hours of confirmation, by email to the billing contact, stating what happened, what data, what we did and what they should do. Regulators as required by law.
5. Review. A written post-incident review, with the fix, published on the updates page.

Business continuity and disaster recovery

• The application is a static file on a global edge; it works offline once loaded. Recovery is a redeploy from source: minutes.
• Licence data is replicated by the platform; billing truth lives in Stripe and can be re-synced to rebuild licences.
• A licence-API outage stops new download authorisations only; audits, previews and processing continue.
• Single-operator risk is real and stated: the source, deployment credentials and procedures are documented so the service can be handed to a successor. Enterprise agreements can include source escrow on request.

Vendor security questionnaire (SIG Lite / CAIQ style)

Answers are current as of 18 September 2026. “No” means we do not have it and say so; “Partial” means a documented limitation.