Security

Your documents stay inside the company:
encrypted, logged, access controlled

This page explains how DocAI protects the documents you entrust to it: where they are stored, who can reach them, what gets logged, and what happens to the data during processing. We wrote it for managing directors, finance leads, IT and data protection officers, in enough detail to fill in a supplier security questionnaire. Every statement here is backed by a working function: what you read on this page can be verified in the code. What we cannot verify, we do not write down, and we list those gaps explicitly at the end of the page.

Security at a glance

The key facts in one place. If it is not here, we do not claim it.

Where the data lives
On the customer's own server, or on a K3Net server in Hungary. By default no customer data goes to third countries; that changes only if the customer switches on an external AI service.
Encryption
Every document file is stored encrypted at rest; traffic between the user and the system runs over TLS.
Logging
Field level change log, including downloads and detail view opens. Kept in yearly separated records; the application offers no log deletion function.
Sign-in
Password, plus two factor authentication (TOTP), available and switchable per user.
Permissions
Role and document type based. Search and document chat also work only on documents the user is allowed to see.
Backup
Encrypted database backup with a retention period, in several copies, daily. In an on-premise install, backups follow the customer's own routine.
Retention
Retention period set per document type in years, with a calculated expiry date per document. Disposal is a manual decision.
AI processing
By default local, on DocAI's own infrastructure. External AI services only if explicitly switched on.
Customer isolation
A separate system instance, database and search index per customer. The AI model server runs on shared infrastructure: it keeps no customer data persistently and does not learn from it.
E-signature
PAdES B-LTA electronic signature with a qualified timestamp and logged signing events.

Last reviewed:

Where is the data?

There are two operating models, and responsibility is split differently in each.

DocAI is the same system in both models, with the same security functions. The difference is where the machines run and who operates them.

On-premise: on the customer's own server

The entire system runs on the customer's infrastructure: document files, database, search index and the AI models as well. Documents never leave the organisation, and processing requires no external service. The system also runs in isolated mode, without an internet connection; in that case only the features that call external data sources are unavailable, for example the connection to the Hungarian tax authority. In this model the customer is responsible for backups, for restore capability and for the network environment, while K3Net is responsible for the system itself.

Operated by K3Net on a server in Hungary

If the customer has no operations capacity of its own, K3Net runs the system on a server in Hungary. The data stays within the European Union. Every customer gets a separate system instance, database and search index; documents and extracted data never mix between customers. The AI model server runs on shared infrastructure: it serves the request but keeps no customer data persistently and does not learn from it. In this model K3Net is responsible for backups, for handling the encrypted copies and for running the server.

Who can see what?

Access is not decided by folder structure, but by role and document type.

Every DocAI user belongs to one or more groups, and the group determines which document types the user can see and what the user may do with them: read, record, edit, approve. Because permissions are resolved at document type level, your organisational logic maps directly onto the system.

  • Finance: incoming and outgoing invoices, bank statements and the related supporting documents.
  • HR: payroll records and employment documents, but not supplier invoices.
  • Management: the full document set.
  • External accountant or subcontractor: only the document type actually needed for the job.

More importantly, permissions do not stop at the list view. Full text search, semantic search and document chat all work exclusively on the documents the given user is allowed to access. If a user cannot open a document, the AI will not answer from it either.

What gets logged?

Not just "someone changed something".

The system keeps a field level change log. Every entry shows who performed the action, when, on which document, on which field, and what the value changed from and to. The log is not limited to editing: downloads and detail view opens are recorded too, so it can be established afterwards who downloaded or opened a given document.

  • Who, when, on which document, on which field, from what value to what value.
  • Downloads and detail view opens are logged as well, not only changes.
  • The log is kept in yearly separated records; the application offers no log deletion function.
  • The full processing trail is retrievable: which step returned what, and which processing stage filled a given field.

In an audit this means a question about one specific document (who saw it, who edited it, when and to what) is not answered by estimation. It can be listed.

Signing in

Sign-in works with a password, and two factor authentication (TOTP, using an authenticator app) is available and can be switched on per user. A strict password policy can be enabled per customer: at least 12 characters, upper and lower case, digit and special character, 180 day expiry. If the customer's internal policy differs, we agree on it during rollout.

Encryption and backup

Every uploaded document file is stored with encryption at rest, so filesystem access alone is not enough to read the documents. Data in transit moves over an encrypted channel, TLS, including all traffic between the user interface and the system.

The database is backed up in encrypted form, with a defined retention period, in several copies, daily. Under K3Net operation this is K3Net's task. In an on-premise install, backups fit into the customer's existing routine: at rollout we hand over which directories and which database must be backed up and what to watch for during a restore, but running and verifying the backups belongs to the customer's IT operations.

Retention and document links

For each document type you can set how many years the related documents must be kept. From this the system calculates an expiry date per document, so it is always possible to query which documents have reached the end of their retention period. Disposal remains a manual decision: expiry does not trigger automatic deletion. A document also cannot be deleted while an approval is in progress on it. A manually deleted document stays in the recycle bin for one year and can be restored; after that the system removes it permanently.

Documents are not isolated files. The system maintains a chain of document links that can be traversed as a graph:

  • a contract and its amendments,
  • an invoice and the contract behind it,
  • an invoice and the matching acceptance certificate,
  • a document and the related project or partner.

So when an invoice is disputed, nobody has to hunt down the referenced contract and the acceptance certificate by hand: the connection is visible from the document record itself.

Where a document has to stand on its own authenticity, electronic signing is available: the system applies a PAdES B-LTA signature with a qualified timestamp and logs the signing events.

The AI runs locally

DocAI's language models run on the system's own infrastructure by default, so document content is not sent to an external provider even for processing. This is not a setting to be found, it is the system's default state.

An external AI service can be brought in if the customer explicitly asks for it, but under three conditions: it has to be switched on deliberately, switching it on is permission bound, and switching it on withdraws the EU AI Act fact sheet, because the processing conditions are different from that point. By default this option is off.

The role of the AI is visible in the interface as well. For every extracted field the system records whether the value came from a user or was read out by the AI. The user supplied value is the source of truth: the AI does not overwrite it. If the AI reads something different, it flags the difference, and the decision stays with the human.

Approval and decision log

Documents are approved inside the system, not over email. An approval round can have a deadline, a deputy can be set for absences, and every decision in the process is logged: who approved or rejected, when, and with what comment. Approval rounds can be built in several steps, so multiple approvers can be involved.

While an approval is in progress on a document, that document cannot be deleted. This delete protection prevents an ongoing case from losing its trail mid-process.

Compliance

GDPR

K3Net signs a data processing agreement with the customer, setting out the purpose and scope of processing, the security measures applied and the question of subprocessors. By default data stays within the European Union; it can reach a third country only if the customer switches on an external AI service, and the data processing record states this explicitly. When a data subject request arrives (access, rectification, erasure), the customer forwards the request to us and we carry it out: today this is not a self service function in the interface, we deliver it as a service.

EU AI Act

DocAI is a decision support system operating under human oversight: the business decision stays with a human, its suggestions and automated steps are logged and can be checked against the source document, and the processing steps are retrievable. The classification of any given deployment always depends on the actual purpose of use, so we review this per rollout. The detailed reasoning is on our blog: AI, GDPR and EU AI Act compliance.

ISO 27001 and NIS2

Certification is granted to an organisation, not to software, so no system can hand its customer an ISO certificate. What we can hand over is evidence: the controls described above (access management, logging, encryption, backup, retention, approval) can be mapped point by point against the expectations listed in the ISO 27001 annex and among the measures required by NIS2, and the reports the system produces can be submitted as evidence in the customer's own audit.

The same applies to records management: the documented information belonging to a regulated operation (supporting documents, minutes, approved records) can be handled in a traceable way in the system, because every view, download and field level change leaves a trail.

NIS2: audits passed by two of our customers

Two of our customers, Trigo Kft. and Duna-Dráva Cement Kft., used DocIT as their records and evidence management system in their successful NIS2 audits. For now they use it without the DocAI extension, but the foundation is shared: everything DocIT can do is also available in DocAI.

Preparing for those audits produced the set of answers that supplier security questionnaires typically ask for. These are the answers we give today:

Our answers to supplier questionnaires

  • Where is the data stored? On the customer's own server, or on a K3Net server in Hungary, in a separate system instance and a separate database per customer. By default there is no transfer to third countries; that changes only if an external AI service is explicitly switched on.
  • Are subprocessors involved in the processing? In an on-premise install, no: processing happens entirely on the customer's infrastructure, without an external AI provider. Under K3Net operation, the provider of the Hungarian server and backup storage is a subprocessor, named in the data processing agreement.
  • How is access controlled? Through role and document type based permissions, which apply to search and document chat as well.
  • What is logged? Field level changes, plus downloads and detail view opens, tied to a user and a timestamp; the application offers no log deletion function.
  • Is two factor authentication available? Yes, TOTP based two factor authentication is available and can be switched on per user; and a strict password policy can be enabled per customer (12 characters, mixed character classes, 180 day expiry).
  • How are backups handled? Encrypted database backups with a retention period, in several copies, daily. In an on-premise install, backups follow the customer's routine, based on the description handed over at rollout.
  • Is the system monitored? Yes: service health, load and errors are collected continuously, and alerting rules fire on outages.
  • How are updates released? Through a controlled release process: a change runs in a test environment first, go-live is verified step by step, and every release leaves a documented trail.

What we do not claim

We write this list down so nothing surprises you during supplier assessment.

  • We hold no ISO certificate. Our controls can be mapped against the standard's expectations and handed over as audit evidence, but that is not certification and does not replace it.
  • Retention expiry does not delete. Retention periods are configurable and expiry is calculated, but expiry never triggers deletion: disposal stays a manual decision. What is automatic: a document moved to the recycle bin by hand is removed permanently after one year.
  • The public share link is not permission bound. Anyone who has the link can open it. This is deliberate: it is how the customer shares what is meant to be public, and switching sharing off invalidates the link.
  • GDPR data subject requests are not served by a self service function. There is no button in the interface that exports or erases a data subject's full record. The customer forwards the request and we carry it out.
  • There is no classic version numbering. What exists is a chain of document links: contract and its amendment, invoice and contract, invoice and acceptance certificate, connected and traceable as a graph. This shows the relationship between documents, not a release number on each file.
  • Everything above applies to the K3Net operated and the on-premise instance alike, except where we flagged the difference, mainly around backups and operational responsibility.

Data security: frequently asked questions

Where are my documents stored?

There are two operating models. On-premise, DocAI runs on your own server and the documents never leave your network. In the K3Net-operated version they are stored on servers in Hungary, in a separate instance and database per customer. By default, in neither case does data leave the EU; that changes only if the customer switches on an external AI service.

Are my documents encrypted?

Yes. Every document file is encrypted at rest, transfers use TLS, and database backups are encrypted and kept with a retention period.

Can I trace who did what with a document?

Yes. The system logs changes at field level (who, when, what, from which value to which), and records downloads and detail view opens as well. The log is kept in yearly separated records; the application offers no log deletion function.

Is two-factor login available?

Yes, with time-based one-time codes (TOTP, e.g. Google Authenticator), enabled per user. A strict password policy can be enabled per customer: at least 12 characters, mixed character classes, 180 day expiry.

Does AI processing send data outside the company?

No. The language models run locally, on DocAI's own infrastructure. External AI services can only be used after explicit activation, tied to permissions, and switching them on withdraws the EU AI Act fact sheet; they are off by default.

Is DocAI ISO 27001 certified?

No, and software cannot be: ISO 27001 certificates are issued to organizations. DocAI's controls (permissions, audit log, encryption, backups, on-premise AI) are comparable with the measures expected by ISO 27001 and NIS2, and can be handed over as evidence for your audit.

Does DocAI help with NIS2 compliance?

Yes, as a records and evidence management system. Two of our customers, Trigo Kft. and Duna-Dráva Cement Kft., used DocIT as their records and evidence management system in their successful NIS2 audits. They currently use it without the DocAI extension, but the foundation is shared: everything DocIT can do is available in DocAI.

How long are documents kept, and can they be deleted?

The retention period is set per document type in years, and the system computes the expiry date. Disposal is a manual decision, and a document under an open approval cannot be deleted. Data subject (GDPR) requests such as erasure or data export are fulfilled on request.

Ask us, and we will show you the control in operation

If your security questionnaire contains a point this page did not answer, ask us: we can show you the specific control in operation. In a demo we walk through permissions, the audit trail and the operating model, mapped onto your own processes.

Request a demo

Get in touch

Fill out the form below and our team will reach out shortly to schedule a demo.

Please provide your name.
Please provide a valid email address.
Please provide a company name.
Format: 12345678-2-41

We only use your data to respond to your inquiry. We do not share it with third parties. Legal basis: your consent and pre-contractual steps (GDPR Art. 6(1)(a) and (b)). For details, see our privacy policy.