Security Overview

DocChat is entrusted with sensitive KYC documentation by UAE financial institutions. Our architecture is built around a small number of strong, verifiable controls: tenant isolation, encryption, key protection, a tamper-evident audit chain, and UAE data residency. This page describes the controls in place today and the items on our security roadmap.

Data Protection & Encryption

Encryption in transit: All connections between the customer's device, the operator console, and our backend are encrypted with TLS. We enforce HSTS across our domains.
Encryption at rest: Documents and data are encrypted at rest using AES-256, managed by the Azure platform.
Key protection: Signing keys for the audit chain are protected by hardware security modules (HSMs) via Azure Key Vault, with purge protection enabled.

Tenant Isolation

DocChat is multi-tenant. Each institution's data is logically isolated at the database layer using PostgreSQL row-level security (RLS), enforced on every query so one institution cannot access another's requests, documents, members, or records.

Network Architecture

Our application and database run on Microsoft Azure in the UAE North region. The database is on a private virtual network, not exposed to the public internet; services reach it over private network paths. Traffic is fronted by Cloudflare, providing web application firewall (WAF) and DDoS protection.

Availability: The database is configured for in-region high availability.

Disaster recovery (roadmap): Cross-region DR within the UAE is on our roadmap; today we operate in-region HA in UAE North.

Access Control

RBAC: DocChat enforces least-privilege through roles. Operators see only the data and actions their role permits; institution administrators retain broader oversight and evidence-export capability.
Document access: Documents are served only through short-lived, signed access links (time-limited SAS URLs); there is no persistent public URL to a document.

Document Handling

Uploads are scanned for malware on receipt; files flagged malicious are not made available. Documents are stored encrypted in UAE North and accessed only via time-limited signed links. Every upload, access, and review decision is recorded to the audit chain.

Tamper-Evident Audit Chain

Every request, document, and operator action is recorded in a cryptographically chained audit log. Each entry is hashed (SHA-256) and linked to its predecessor, so altering any entry breaks the chain and is detectable. The chain root is signed with an HSM-protected key. Entries use RFC 8785 canonical JSON serialization, and institutions can export signed evidence packages for inspection.

Security Roadmap

The following items represent our future development intent (no specific delivery dates are defined):

SOC 2 compliance audit (Type 1, followed by Type 2).
Independent third-party penetration testing.
Cross-region disaster recovery within the United Arab Emirates.

Vendor Due Diligence

We welcome review by your risk and information-security teams. Contact us to discuss our architecture and request available documentation under NDA.