The documents people send us are the ones they cannot replace
Birth certificates, wills, clinical charts, parish registers. There is no version of this product that works if the handling of those is casual, so the boundaries are structural rather than procedural.
The short version
- Your documents belong to your account.
- Nothing is used to train anything.
- Every storage connection is read-only.
- Deleting a job deletes everything in it.
Six boundaries, and where each one sits
Account isolation
Every document, collection and job belongs to the account that created it. There is no cross-account visibility and no shared pool - the isolation is enforced at the query layer, not by a UI filter.
Sessions
Sessions are signed tokens held in an httpOnly cookie, so page scripts cannot read them. Protected routes are guarded server-side rather than by a client-side redirect.
Read-only integrations
All six storage integrations - Drive, Dropbox, OneDrive, S3-compatible, WebDAV and pasted links - are read-only. Docovly can list and fetch what you point it at. It cannot write, move or delete anything in your storage.
Your own keys, your own account
Storage application keys are stored against your account, encrypted. There is deliberately no view anywhere in the product that exposes the deployment's own environment configuration.
No training on your documents
Nothing uploaded is used to train any model. Documents are processed for the job you asked for and for nothing else.
Deletion means deletion
Deleting a job removes the restored files, every intermediate version and the original capture. There is no shadow copy retained for analysis.
Operators never see the engine
The separation is enforced by the module layout rather than by convention: the client-safe modules carry types, damage vocabulary and labels, while models, instructions and unit costs live in server-only modules that a client component cannot import.
- Providers, models and prompt instructions are server-side only and never reach the browser
- Per-run costs and engine details are not exposed to operators
- Engine failures are translated into plain language before they leave the server
- There is no prompt box, so no operator-supplied text ever reaches a model
Questions we get from procurement
If your organisation needs something not covered here, ask - Enterprise exists for exactly those requirements.
Have a document you are not sure about?
Send us a photograph of it. We will tell you honestly whether it is recoverable before you spend anything.
Ask usAgainst your account, in the deployment's own storage. They are listed, downloaded and deleted from My Documents, and every restoration job keeps its original capture and every version until you delete the job.
Reporting a vulnerability
Email support@docovly.com with the details and we will acknowledge it. Please give us a reasonable window to fix anything before disclosing it publicly.
Run a security review first
Most institutions do, and we would rather you did. Tell us what your process needs and we will work to it.