Workspace isolation
Every query is scoped to a workspace. Projects, documents, tokens and files cannot cross tenant boundaries.
Security
Security and control, without the hand-waving.
dicimint holds documents that carry regulatory weight. This page explains what protects them, what we have not earned yet, and how to ask us the hard questions.
Controls
Six things that make the record trustworthy.
Security is not a badge on a page. It is a set of invariants the product enforces on every request.
Immutable revisions
Approved revisions are fixed records. Database triggers prevent edits to revision content after it is written.
Role-based access
Owner, admin, manager, contributor, reviewer and viewer roles. Every mutation goes through one authorization chokepoint.
Audit trail
Logins, edits, reviews, approvals, token use and MCP writes are recorded with actor, time and outcome.
Backups and recovery
PostgreSQL and object storage are backed up together. Restore drills are run before production changes.
Deployment choice
Shared cloud, dedicated stack or self-host. Enterprise customers can keep data in their own environment.
Data flow
Where your documents live.
The app, collaboration sidecar, PostgreSQL and object storage run in the same private network. Only the app is exposed through TLS.
- Browser sessions use HttpOnly, Secure, SameSite cookies.
- File uploads are type-checked and stored in a private bucket.
- Collaboration traffic is authorized at the WebSocket layer.
- Outbound webhooks are signed and SSRF-protected.
- AI providers are optional and configured per deployment.
AI and agent writes
AI is disabled by default. When enabled, it can summarize, check consistency and answer questions. It cannot approve, submit, delete or change permissions.
- MCP is read-only by default.
- Writes require a workspace opt-in and a separate token scope.
- Every write needs explicit confirmation and an idempotency key.
- Tokens can be restricted to specific projects.
- Move, archive, delete, submit, approve and reject are not exposed.
Compliance posture
We do not claim certifications we have not earned.
Here is the current state. If a certification is a hard requirement for you, tell us — it is better to know before a pilot than after.
| Item | Current status |
|---|---|
| SOC 2 Type I | Roadmap — not claimed yet |
| ISO 27001 | Roadmap — not claimed yet |
| GDPR / DPA | DPA available on request |
| Penetration test | Before first Enterprise contract |
| Uptime SLA | Enterprise agreements |
| Data residency | Enterprise option |
Operations
Backups, retention and incident response.
Production changes follow a written deploy policy: backup, upgrade rehearsal, SHA-tagged image, smoke test and a rollback tag.
Questions we expect
- Where is data hosted? Answered per deployment and region.
- How long is it retained? Configurable on Business and Enterprise.
- Who has access? Named operators, audited actions.
- What happens on deletion? Export window, then verifiable deletion.
- How are incidents handled? Severity levels, customer comms, post-mortem.
Subprocessors
A short list. Clear purposes.
We use a small set of infrastructure providers for hosting, object storage, email, payments and error tracking. The current subprocessor list with purposes and locations is provided with the DPA and updated before a new provider is added.
Last reviewed: November 2026. This page is updated when the controls or providers change.
Bring your security questionnaire.
We will answer it in writing, map each answer to the product, and tell you honestly where we are still on the roadmap.