LEGAL · SECURITY

Security at Abscode.

Last updated: 28 October 2026. One security statement for every Abscode service.

Certification status

We are not yet SOC 2 or ISO 27001 certified

SOC 2 and ISO 27001 are on our roadmap; no Abscode product is currently certified against either. We are happy to share our current control set, our architecture notes and recent penetration-test summaries on request — email [email protected]. We design against the ISO 27001 and SOC 2 Trust Services Criteria, and the services are built to support customers’ DPDP, GDPR and POPIA obligations, but alignment is not certification and we will not describe it as such.

Encryption

In transit, TLS 1.2 or above. At rest, AES-256.

Document retention and deletion

These are two different data paths, not two versions of one policy:

Document AI and the SDKs

  • Default purge within 24 hours of API response delivery.
  • Optional 5-minute purge, configurable per API key.
  • Enterprise: custom retention or zero-retention.
  • Request logs retained 90 days by default; up to 7 years for Enterprise where required.
  • Mobile and browser processing happens on the user's device and never reaches us.

Abscode DMS

  • Records persist — that is the product. Retention is tunable per document type.
  • The audit trail is retained with tunable retention and is tamper-evident.
  • On termination, 30 days to export, then deletion.
  • Documents are compressed before storage.

Data residency

We host in these regions: India (GCP Mumbai), EU/EEA (GCP Belgium), Africa and the Middle East (GCP Johannesburg), and the United States. No cross-region transfer without customer instruction. For the exact region a given product or tenant runs in, ask [email protected].

Enterprise DMS customers may use bring-your-own-storage — Google Drive, OneDrive, S3, Azure or NAS — so records live in storage you own and you control location and ownership. Where you do, our at-rest encryption and residency commitments apply to our own systems only, not to your storage.

Access control

  • Role-based access, access by document group, and confidentiality set on the document type.
  • PII masking for Aadhaar and PAN on view; the Aadhaar number is not stored.
  • Maker-checker approval on every DMS edition, including Free.
  • Single sign-on from the Professional edition; SAML on Enterprise.
  • Multi-factor authentication and multi-level approvals are available by plan.
  • IP allowlisting for Enterprise.
  • Documents can be shared by an external link that expires.

Control availability varies by product and by plan. For the control matrix that applies to your plan, contact [email protected].

Audit logging

A complete, tamper-evident audit trail on every DMS edition, including Free: who did what, to which document, when. For the APIs, request metadata is logged for billing, rate-limiting and abuse investigation.

Application security

  • Mitigations for the OWASP Top 10 are part of our development process.
  • Dependencies are monitored and patched.
  • The site loads no third-party scripts, which removes supply-chain and tracking risk from the browser.

Sub-processors

Hosting, payment processing (Razorpay in India, Stripe elsewhere), email delivery and support tooling. Each is engaged under contract and only for that purpose. We give notice before adding a sub-processor that processes Customer Content. The current list is available on request from [email protected].

Report a vulnerability

Email [email protected]. We acknowledge within 24 hours and will keep you updated as we triage and fix. Please do not publicly disclose until we have shipped a fix — we will agree a timeline with you and we will not threaten researchers who follow this process.