Security Features
Understanding DocAssure's comprehensive security features to protect your documents and data
Security Overview
DocAssure employs a multi-layered security approach to protect your documents and data at every level. Our security architecture incorporates industry best practices, including ISO 27001 standards, to ensure the confidentiality, integrity, and availability of your information.
This guide explains DocAssure's key security features and provides information on how to configure and use them effectively to meet your organization's security requirements.
Key Security Features
Authentication & Access Control
Multi-factor authentication, role-based access controls, and session management to ensure only authorized users can access your data.
Data Encryption
AES-256-GCM encryption for data at rest and TLS 1.3 for data in transit, ensuring your information remains secure.
Audit Logging
Comprehensive logging of user activities, document access, and system events for compliance and security monitoring.
Document Security
Digital signatures, document access controls, and granular permission settings to protect document integrity.
Authentication & Access Control
Multi-Factor Authentication (MFA)
DocAssure supports multiple MFA methods, including Time-based One-Time Passwords (TOTP), hardware security keys, and biometric authentication. MFA can be enforced for all users or specific user groups based on your security policies.
Role-Based Access Control (RBAC)
Pre-defined roles with appropriate permissions ensure users have access only to the resources they need. Available roles include administrator, records manager, compliance officer, security officer, and more, each with carefully scoped permissions.
Session Management
Configurable session timeouts, concurrent session limits, and secure cookie settings protect against unauthorized access. Administrators can view and terminate active sessions if suspicious activity is detected.
Password Policies
Enforce strong password requirements, including minimum length, complexity, expiration periods, and password history. DocAssure also supports secure password reset workflows with time-limited tokens.
Data Encryption
Data at Rest
- All document content and metadata stored using AES-256-GCM encryption
- Encryption keys managed with secure key storage and regular key rotation (every 90 days)
- Hardware Security Module (HSM) support for enterprise deployments
- Tenant isolation ensuring data from different organizations remains separate
Data in Transit
- TLS 1.3 with perfect forward secrecy for all communications
- Strong cipher suite enforcement (TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256)
- API calls and file transfers secured with the same high-grade encryption
- Regular security scans to identify and address potential vulnerabilities
Audit and Compliance
Audit Logging
DocAssure maintains detailed audit logs for the following events:
- Document access and modifications
- User authentication attempts (successful and failed)
- Administrative actions and configuration changes
- Security-related events such as permission changes
- API usage and system operations
Audit Log Management
- Retention: Configurable retention periods based on compliance requirements (Enterprise: 7 years, Personal: 30 days, API: 60 days by default)
- Tamper Protection: Cryptographic mechanisms ensure logs cannot be altered
- Export: Audit logs can be exported for analysis or compliance reporting
- Real-time Monitoring: Security events can trigger alerts for immediate response
Document Security
Access Controls
- Granular permissions for viewing, editing, printing, and downloading documents
- Document access can be restricted by user, role, department, or custom groups
- Time-limited access capabilities for temporary collaborators
- Optional watermarking to identify document origins and track distribution
Digital Signatures
- Built-in digital signature capabilities using OpenPGP with 4096-bit keys
- Integration with external signature providers like DocuSign and Adobe Sign
- Compliant with regulatory requirements for electronic signatures
- Signature verification and timestamping to ensure document integrity
Document Lifecycle Security
- Secure document disposal with cryptographic erasure when retention periods expire
- Version control with complete audit history of document changes
- Secure archiving with maintained encryption and access controls
- Legal hold capabilities to prevent deletion of documents under investigation
Regulator Portal
DocAssure provides a secure, read-only portal for external regulators to access compliance information about your organization. This allows regulators to monitor compliance status without requiring full system access.
Portal Features
- Compliance Dashboard: Overview of compliance scores across all frameworks
- Entity Monitoring: View authorized entities and their consent status
- Risk Distribution: See risk levels (low, medium, high, critical) across entities
- Trend Analysis: Track compliance trends over time
- Anomaly Detection: View automatically detected compliance anomalies
Access Control
- Separate authentication system for regulator accounts
- Read-only access - regulators cannot modify any data
- Access scoped to specific frameworks the regulator oversees
- All regulator access is logged for audit purposes
Setting Up Regulator Access
To configure regulator portal access, navigate to Settings → Security → Regulator Access. You can create regulator accounts, assign jurisdiction and framework permissions, and monitor regulator login activity from this section.
Security Best Practices
Enable Multi-Factor Authentication
Require MFA for all users, especially those with administrative or elevated privileges. This significantly reduces the risk of unauthorized access, even if passwords are compromised.
Implement Strong Password Policies
Enforce complex passwords with a minimum length of 12 characters, including special characters, numbers, and mixed case. Set reasonable expiration periods and prevent password reuse.
Regular Security Audits
Review audit logs and user access rights regularly. Remove unnecessary permissions and deactivate unused accounts promptly. Schedule periodic security reviews of your DocAssure configuration.
Security Troubleshooting
Access Denied Errors
Issue: Users receive "Access Denied" errors when attempting to access documents or features.
Solution: Verify the user's role and permissions. Check if they have the necessary access rights for the specific document or feature. Review any recent permission changes in the audit logs.
MFA Setup Issues
Issue: Users are unable to complete MFA setup or verify their second factor.
Solution: Ensure the user's device time is synchronized correctly for TOTP. For hardware tokens, check device compatibility. Administrators can temporarily disable MFA for a user to allow them to re-configure their authentication method.
Digital Signature Verification Failure
Issue: Digital signatures cannot be verified or applied to documents.
Solution: Check that the certificate used for signing is valid and not expired. Verify the signing service configuration and connectivity. For third-party signature providers, ensure API credentials are current and correctly configured.