Privacy & Trust # How we work, and what each practice covers. Each practice says what it covers: this website, our company, or the DocuPrivé platform, which is in development. Reviewed 29 October 2026 - [Overview](https://docuprive.com/trust/) - [Practices & controls](https://docuprive.com/trust/controls/) - [Documents & resources](https://docuprive.com/trust/resources/) - [Service providers](https://docuprive.com/trust/subprocessors/) ## 1 Reviewing changes to this website This website - We use a documented process to review website changes before publication. - Each release is approved as an exact set of files, identified by a fingerprint, before it is published. - Publishing is a separate step performed by the company; the tools that build the website are not given publishing credentials. - Statements about the product are checked against a single record of what exists and what is only designed, and that record is reviewed before each release. ## 2 Protecting this website This website - These pages carry no analytics or advertising and load no third-party scripts, except the security check on the sign-up form. - A strict content security policy limits what pages can load and where forms can send information. - Sign-up rate limits use keyed one-way hashes instead of storing email or IP addresses in readable form. - Report a security concern to [security@docuprive.com](mailto:security@docuprive.com). Our security.txt file is at [/.well-known/security.txt](https://docuprive.com/.well-known/security.txt). ## 3 Privacy requests This website and update emails - To use your privacy rights, or to ask how we handle your information, write to [privacy@docuprive.com](mailto:privacy@docuprive.com). [Section 10 of the Website Privacy Notice](https://docuprive.com/privacy/#10-your-rights-and-how-to-use-them) explains your rights where you live. - Every update email lets you unsubscribe. - Writing to us or visiting this website is never treated as consent to marketing. ## 4 Designing the platform DocuPrivé platform, in development These principles shape every part of the product. They are commitments about design; where a principle depends on a stage that is not built yet, it says so. - **Access is for intended people.** It starts with a verified receiving email address, and relates to a task or a Room, not to everything an organization holds. In our development build, for Request details - **Access has an end.** Access is designed to end when the work does; in the development build every Request carries an exact end date and time and can be revoked. In our development build, for Request details - **External people stay external.** A recipient sees only the Request they were asked to answer and does not join the requesting organization. In our development build - **Content and records are kept apart.** Document content and lifecycle records are designed to be stored separately, each with its own access and retention rules. Designed, not yet built - **Decisions have owners.** Keeping, reviewing and ending material are decisions with an accountable person. Automated assistance will not decide on its own to hold, keep or dispose of material. Designed, not yet built - **Records are honest about what they prove.** A record shows that something happened in DocuPrivé. It does not prove that a person read or understood a document, and we will not present it that way. - **Customer documents are not a product.** Customer documents are not sold, used for advertising, or used to train general-purpose AI models. Designed, not yet built - **Security is described as built.** Encryption and access will be described exactly as built. Nothing will be called end-to-end encrypted or zero-knowledge unless it is, and we can show it. Designed, not yet built - **Ending access is not un-sending.** DocuPrivé can end access it controls. It cannot reach copies already downloaded, or change permissions in someone else's system. [What recall can and cannot do](https://docuprive.com/resources/what-recall-can-and-cannot-do/) This page describes our controls by principle and by current status, so you can judge them. It leaves out implementation detail whose main use would be to attack the service. ## 5 Independent assessment Company We list an independent assessment or certification here only once it has been issued, with what it covers, who performed it and when. We do not present our providers' certifications as our own. Security questionnaires and due-diligence requests: [security@docuprive.com](mailto:security@docuprive.com).