DocnezTrust and security
How Docnez protects your documents, what we have in place today, and what is still on our roadmap.
Last updated: . Docnez is in a free beta, operated by Nezuna Technologies Inc. (Ontario, Canada). We only list controls that are live today. Anything not yet done is listed under On our roadmap.
Certifications: Docnez does not hold SOC 2, ISO 27001 or any other third-party security certification yet.
Security controls in place today
| Area | What we do today |
|---|---|
| Encryption in transit | All traffic to docnez.com and app.docnez.com is HTTPS only (TLS 1.2 and 1.3), with HTTP Strict Transport Security. Plain HTTP is redirected to HTTPS. |
| Encryption at rest | Uploaded documents and other stored files are encrypted at rest with AES-256-GCM. Encryption keys are kept outside the data directory. |
| Sign-in | Passwords are stored as Argon2id hashes, never in plain text. Email confirmation is required before sending documents. Session cookies are HttpOnly and Secure. |
| Two-step sign-in (2FA) | Optional two-step sign-in with an authenticator app (TOTP) and one-time recovery codes. Authenticator secrets are stored encrypted (AES-256-GCM) with a key kept outside the database. |
| Per-signer access codes | Senders can set an optional access code for each signer. The code is never included in the email. Five wrong tries lock that signing link for 15 minutes. |
| Rate limits | Sign-in, sign-up, password reset and two-step codes are rate limited per IP address, and repeated wrong two-step codes temporarily lock that step for the account. |
| Audit trail | Uploads, views, consent, signatures and completion are logged with time, IP address and device. The log is included in every signed PDF. |
| Tamper-evident seal | Each completed PDF is digitally sealed and includes a certificate of completion with SHA-256 document hashes. Anyone can check a signed PDF on the public Verify page. The sealing certificate is issued by Docnez, not yet by a certificate authority on Adobe’s trusted list, so Adobe Reader may show the signature as "validity unknown" even though the Verify page confirms it. |
| Browser protections | Strict Content Security Policy, clickjacking protection (frame-ancestors none), nosniff, a strict referrer policy and a restrictive permissions policy on both the site and the app. |
| Backups | Automatic nightly backups on the server (kept for 14 days), plus off-server encrypted backups in Canada (Backblaze B2). Off-server copies are encrypted before upload. |
| Privacy-friendly analytics | First-party page statistics with no advertising trackers. Do Not Track and Global Privacy Control are honoured. |
Data handling
- Where data is stored: on a server we operate at OVHcloud in Canada. The database runs on that same server. Encrypted off-server backups are stored in Canada.
- What we store: account details (name, email), the documents you upload, signer names and emails, signatures, and the audit trail.
- Who can see it: you and the people in your workspace, and signers for the documents sent to them. Docnez staff access data only to run the service, handle support requests you make, or meet legal obligations.
- We do not sell personal data and do not use your documents to train AI models.
- Deletion and access requests: email hello@docnez.com or use the contact form. Self-serve account deletion and data export are on our roadmap.
Subprocessors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OVHcloud | Server hosting, storage and on-server backups | All service data | Canada |
| Backblaze B2 | Off-server encrypted backups | Encrypted backup data (ciphertext only) | Canada |
| Resend | Sending verification, signing-request and notification emails | Names, email addresses, email content, delivery events | United States |
| Zoho Mail | Our support mailbox | Messages you send us | Canada |
No payment processor is used during the free beta. We will update this list before adding a new provider that processes customer personal data. The Privacy Policy and Terms remain under legal review.
On our roadmap
- A document-sealing certificate from a certificate authority on Adobe's trusted list.
- Self-serve account deletion and data export.
- A public status page.
- A third-party penetration test, then SOC 2.
Report a security issue
Found a vulnerability? Please read our vulnerability disclosure policy and email hello@docnez.com with "Security" in the subject. Our security.txt has the same details.