Truth-first trust center

Know what is protected, what is gated, and what still needs proof.

This register separates released product behavior, source-backed safeguards, and missing third-party assurance. A design control is never presented as a certification.

Review the control register Report a security concern

Trust review: July 29, 2026
Catalog version: 2026-07-29.1
Available capabilities: 3
Certification-pending: 4

Current document boundary

File upload is not released.

Do not send production client documents through DocScoop yet. Continue using the delivery channel your firm has already approved.

The source contains a gated storage path, but malware scanning, quarantine, safe document preview, retention, and restore evidence remain open release requirements.

Public guidance boundary

Public Help Boundary

The public help assistant accepts general product questions only. The raw question stays within the DocScoop API for safety screening and retrieval against the reviewed public knowledge base.

An optional wording provider may receive only controlled public help excerpts and limited retrieval context. It does not receive the raw question, workspace data, client data, documents, portal links, credentials, or payment data.

The assistant is not account support, legal, accounting, or document-review advice. Use the published support and privacy contacts for account-specific requests.

Control register

Every safeguard carries its evidence boundary.

“Source-backed” means the control is represented in the current application or migration source. It does not mean an independent reviewer has certified production operation.

Web transport and browser boundary

Source-backed control

The public web service is delivered over HTTPS and the application publishes browser policies for transport, framing, content types, referrers, and high-risk browser permissions.

Evidence present

HSTS, Content Security Policy, anti-sniffing, frame, and referrer headers are defined for public responses.
Camera, microphone, geolocation, payment, USB, and browsing-topics browser permissions are disabled by policy on the web surface.
Workspace and portal routes publish noindex, nofollow, and noarchive response policy.

What this does not prove

This source evidence is not an independent penetration test, database-transport attestation, or at-rest encryption certification.

Current web response policyLocal security-header acceptance test

Staff sessions and tenant boundary

Source-backed design

Staff requests use bearer authentication and workspace records carry organization ownership. The browser keeps the current staff token in tab-scoped session storage rather than persistent local storage.

Evidence present

The web client sends the staff token only on authenticated API requests.
Signing out, replacing a token, or receiving an unauthorized response clears staff-session artifacts.
Core workspace tables model organization ownership for clients, engagements, documents, reminders, summaries, and activity records.

What this does not prove

Multi-seat role and invitation lifecycles are not released, and DocScoop does not publish an independent tenant-isolation or role-control certification.

Current staff web clientOrganization-scoped database schemaTyped release catalog

Client portal token lifecycle

Available in early access

A firm can share a passwordless link for one engagement so the client can review that engagement's checklist without creating an account.

Evidence present

The database model stores a portal-token hash rather than the raw link token.
The portal request path encodes the token and does not create a staff session.
Invalid, expired, or unavailable links fail closed without exposing a client or engagement view.

What this does not prove

The URL is a bearer credential: anyone who possesses it may use it until it expires or is revoked. An exact public lifetime is not promised, so the link should not be forwarded, pasted into tickets, or stored in shared notes.

Typed release catalogPortal request flowPortal-token database model

Upload, quarantine, and document preview

Not released

The upload path is present behind a closed release gate. Production client documents should continue through the firm's already-approved delivery channel.

Evidence present

The intended path uses non-public object storage, presigned upload targets, and a separate server confirmation step.
The portal UI limits its planned chooser to images and PDF files, while the server contract is expected to validate the stored object again.
Storage-object identity has a source-level uniqueness guard to reduce duplicate confirmation.

What this does not prove

DocScoop does not claim a released malware scanner, quarantine workflow, safe document preview, checksum-bound evidence package, object-retention policy, or upload backup-and-restore certification.

Typed release catalogGated portal sourceUpload-integrity database migration

Retention, export, and deletion

Policy evidence pending

Verified access, export, deletion, and account-closure requests are handled through the published privacy contact.

Evidence present

The product discloses that self-service organization export and deletion controls are not released.
Client records can be archived in the current workspace; archive is not presented as erasure.
Deletion may depend on verified authority, security and fraud needs, backup cycles, and legal obligations.

What this does not prove

There is no published fixed customer-data retention schedule, deletion completion time, backup purge interval, or DocScoop-specific restore report.

Privacy policyTerms of serviceCurrent settings disclosure

Activity records and evidence

Limited source evidence

The data model includes organization-scoped activity records, and released workspace surfaces can show recorded activity and preparation summaries.

Evidence present

Activity records model actor, action, entity, organization, metadata, and timestamp fields.
Preparation summaries preserve a version and generation source.
Billing webhook source includes event identifiers and body-hash uniqueness guards, while checkout remains closed.

What this does not prove

DocScoop does not claim a tamper-evident or independently audited event store, an immutable close-pack export, signed evidence manifests, or a customer-downloadable audit report.

Activity and summary database schemaBilling event safety migrationTyped release catalog

Monitoring and incident reporting

Operational disclosure

The platform has source wiring for uptime, infrastructure, and application-error visibility, and publishes a private security reporting address.

Evidence present

Security reports can be sent to security@docscoop.com with the affected URL, impact, and safe reproduction details.
Reporters are asked not to include client documents, portal links, credentials, or other sensitive content in email.
Monitoring is described as detection support, not a guarantee that every anomaly is found before impact.

What this does not prove

DocScoop does not publish an uptime SLA, security-response SLA, public incident archive, guaranteed response time, or independent monitoring attestation.

Published security contactCurrent runtime-monitoring wiringPublic security disclosure

Independent assurance and compliance

No certification published

DocScoop does not currently present itself as SOC 2, ISO 27001, PCI DSS, HIPAA, or otherwise independently certified.

Evidence present

The public product copy explicitly separates source-backed safeguards from third-party assurance.
Payment checkout remains closed, so no payment-card processing claim is made for the DocScoop application.
Certification-pending capabilities remain disabled in public product flows.

What this does not prove

No audit report, penetration-test letter, formal risk register, signed DPA register, or compliance certificate is available from this page.

Typed release catalogPublic legal and security disclosures

Access lifecycle

Two access paths, two explicit limits.

Staff authentication and a client portal link are not interchangeable. The link is intentionally narrower, but it must still be handled as a credential.

Workspace early access

Staff session

Issue
The authentication service returns a bearer token after a successful staff sign-in.
Keep
The web client stores the token in sessionStorage for the current browser tab.
Use
Authenticated workspace calls attach the token and are expected to apply user and organization checks.
End
Sign-out, token replacement, or an unauthorized API response clears browser-session artifacts.

No public maximum session lifetime, MFA guarantee, device-session dashboard, or global session revocation workflow is claimed.

Checklist view early access

Client portal link

Create
The firm creates a link for a specific engagement.
Share
The raw token travels in the URL; the database model keeps its hash.
Scope
The portal uses the link to request that engagement's client-facing checklist view.
End
The link stops working when it expires, is revoked, or is replaced.

A portal link is not a public URL. Share it only through a channel the firm has approved and contact the firm if it may have been exposed.

Release register

The catalog decides what can be used.

Catalog 2026-07-29.1, reviewed 2026-07-29. The trust center copies every capability state from that source.

Client, engagement, and checklist tracking

Available

Available in the early-access workspace.

Magic-link client portal

Available

Portal links and checklist views are available in early access.

Client and staff file uploads

Certification pending

Storage credentials and the end-to-end upload lifecycle are being certified before release.

Reminder email delivery

Certification pending

Provider authentication and delivery evidence are being certified before release.

Preparation summaries

Available

On-demand summaries are available in the workspace.

Multi-seat role-based access

Certification pending

Team invitation and permission lifecycles are not publicly released.

Paid checkout and subscription lifecycle

Certification pending

Checkout stays closed until organization binding and provider lifecycle tests pass.

Commerce: Paid checkout is not open yet. The Pro catalog is a preview and no payment can be started from DocScoop today.

Service and integration register

No logo wall. Only disclosed dependencies and their limits.

This is an operational dependency disclosure—not a completed contractual subprocessor register. Legal entity names, DPAs, processing locations, retention terms, and change-notice commitments are not yet published as a formal register.

The public-help flow has an additional boundary: the raw question is not sent to the optional wording provider. Only controlled public material and limited retrieval context may leave the DocScoop API.

External service

Hetzner-hosted infrastructure

Disclosed dependency

Purpose: European server infrastructure for the web application and supporting services.
Data boundary: Service and infrastructure data required to host and operate DocScoop.
Public limit: DocScoop does not publish a customer-selectable region, independent hosting attestation, or infrastructure SLA.

Self-hosted service

Self-hosted core data services

Mixed release state

Purpose: PostgreSQL workspace records and MinIO-compatible non-public object storage.
Data boundary: Workspace metadata is in use; the production document-upload lifecycle remains release-gated.
Public limit: No DocScoop-specific at-rest encryption, malware quarantine, object lifecycle, or restore certification is published.

Optional integration

Google Sign-In

Optional

Purpose: Optional account authentication chosen by the user.
Data boundary: Authentication response and account email when the user chooses Google.
Public limit: Google authentication availability depends on environment configuration; email/password remains a separate entry path.

Self-hosted service

Plausible analytics

Source wired

Purpose: Aggregate public-site usage measurement without traditional tracking cookies.
Data boundary: Public-page analytics; no account token or client document is intentionally included.
Public limit: The analytics configuration is not presented as an independent privacy certification.

Self-hosted service

GlitchTip error monitoring

Environment dependent

Purpose: Application-error visibility when an environment provides a monitoring endpoint.
Data boundary: Technical error envelopes; private business content is not intended as monitoring payload.
Public limit: Exact production enablement, payload redaction, and retention are not independently attested on this page.

External service

Brevo email delivery

Reminder delivery gated

Purpose: Transactional email provider selected for notification workflows.
Data boundary: Recipient and message data only when a provider-authenticated workflow is released and invoked.
Public limit: Automated reminder delivery is not released; sender authentication and delivery lifecycle evidence are still required.

External service

LemonSqueezy commerce

Checkout closed

Purpose: Selected provider for a future subscription checkout and customer billing portal.
Data boundary: Billing and customer identifiers only after an organization-bound checkout is opened.
Public limit: Paid checkout is not open yet. The Pro catalog is a preview and no payment can be started from DocScoop today.

Optional integration

Optional public-help wording provider

Public-only boundary

Purpose: Rewrite grounded public help excerpts when an approved provider is configured.
Data boundary: Controlled public-help excerpts and limited retrieval context; the raw submitted question is excluded.
Public limit: The provider identity and contractual register are not published; do not use public help for client, credential, portal-link, or account-specific content.

Evidence register

What can be inspected—and what cannot.

Evidence available now

A versioned product catalog with capability-by-capability release state and review date.
Source-defined browser response policies plus local security and indexing acceptance checks.
Organization-owned data tables, hashed portal-token storage, and upload-object uniqueness guards in migration source.
Published privacy, terms, vulnerability-reporting, and data-rights contact paths.
Fail-closed UI gates for upload, reminder delivery, multi-seat roles, and checkout.

Evidence not currently published

Independent penetration test, tenant-isolation assessment, or security audit report.
SOC 2, ISO 27001, or another third-party compliance certificate.
DocScoop-specific at-rest encryption and database-transport attestation.
Released malware scanning, quarantine, safe preview, and upload restore-drill evidence.
Fixed retention and deletion schedule with backup-purge timing.
Tamper-evident audit export, signed evidence manifest, or immutable close pack.
Formal subprocessor register with legal entities, processing locations, DPAs, and change notice.
Published uptime, incident-response, or support-response SLA.

Private reporting channel

Report a vulnerability without sending sensitive data.

Include the affected URL, observed impact, and safe reproduction details. Do not attach client documents, credentials, portal links, access tokens, or payment data. No response-time or bounty promise applies unless confirmed in writing.

security@docscoop.com Privacy and data requests