Data Residency & Blind-Custody Encryption
Keep your documents physically resident in your chosen African jurisdiction — and hold independently verifiable proof of it.
Blind custody: the host stores your data but cannot read it
Documents stored in a residency region are envelope-encrypted with AES-256-GCM before they sit at rest. Every document gets its own encryption key; that key is itself encrypted ("wrapped") by a master key that never leaves Doc-Assure's own infrastructure and is never deployed to the hosting datacenter.
The practical effect: the datacenter operator — or anyone who obtains the storage disks — holds only ciphertext. Each document's ciphertext is also cryptographically bound to that document's identity, so encrypted files cannot even be swapped for one another without detection. Tampering with a single byte makes the file fail authentication instead of decrypting.
When you delete a document permanently, Doc-Assure also destroys its wrapped key (crypto-shredding): even a stray backup of the storage becomes permanently unreadable. This is how POPIA-grade erasure survives infrastructure you don't control.
Honest boundary: Doc-Assure itself can read your documents — that is what lets OCR, search and AI chat work, and it is the same trust you already place in us. Blind custody removes the hosting provider from your trust equation, not Doc-Assure. Metadata such as object sizes and timing is not hidden by encryption. Audio and video files are currently excluded from at-rest encryption — whole-file encryption breaks in-app streaming playback — and are protected by standard access controls until seekable encryption ships.
The residency certificate — and how to verify it yourself
Cryptography can prove what data exists (hashes), who attested to it (signatures) and when (timestamps) — but no certificate can, by itself, prove where bytes physically sit. That is why the certificate stacks three independent evidence layers instead of over-claiming one:
- Cryptographic (Doc-Assure signs). The hash of every encrypted document is a leaf in a Merkle tree; the root is signed with Doc-Assure's Ed25519 key and appended to a hash-chained transparency log that cannot be silently rewritten.
- Institutional (the host attests). The datacenter's signed location statement and no-egress guarantee, with on-site audit available.
- Independent (you check). The certificate lists the server address so you can corroborate its network location yourself.
Verification needs no Doc-Assure account — the endpoints are public and expose hashes only:
- GET /api/residency/root?tenant=… — the latest signed Merkle root + public key
- POST /api/residency/verify — inclusion proof for one document's ciphertext hash
- POST /api/residency/challenge — live proof the server holds your encrypted bytes right now
- GET /api/residency/log?tenant=… — the full tamper-evident history of published roots
While a region's in-country datacenter is still being provisioned, certificates carry a clear SPECIMEN marking: the cryptographic layer is live and real; the physical-location layer activates at cutover. We never claim in-country hosting before it is true.
Recent search & AI upgrades you should know about
- Whole-drive search. On mobile, the magnifying glass now searches your entire drive from the root, recursively, from any folder.
- Zip contents are searchable. Uploaded archives are indexed by their contents: a search term matching a file inside a .zip returns the archive in the same results, and AI chat knows what each archive contains.
- Pictures get AI descriptions. Images uploaded as documents are analysed by Doc-Assure's own vision models (never third-party AI services): a scene description plus any text visible in the image becomes searchable and answerable in AI chat.
- Accurate repository counts. AI answers about your repository count only your active documents — items in the recycle process are excluded.
- Audio & video playback. Recordings and videos stored in Drive play inline on mobile, with transcription available.
Choosing and proving your region
Set your primary residency region under Settings → Residency (web) or Accounts → Region & Residency (mobile). Documents you upload are stored in that region; optional replica mirrors can be added per region. Your certificate is downloadable from the mobile app's Region & Residency screen.
Drivers: POPIA, ECTA, the Legal Practice Act, AFSA arbitration requirements, and African data sovereignty generally. Legal residency usually turns on the records themselves — your source documents — which is exactly what the residency layer covers.