Security built into every docs site you publish
Encrypted in transit and at rest, isolated per organization, private down to the page, and never used to train AI. GDPR is covered by our DPA today, with SOC 2 Type II, ISO 27001 and HIPAA in progress.
Compliance
GDPR
A Data Processing Addendum with Standard Contractual Clauses for transfers from the EU, the UK and Switzerland.
SOC 2 Type II
Preparing with Scrut, with the observation period beginning in Q4 2026.
ISO 27001
An information security management system aligned with ISO/IEC 27001:2022. Certification expected in Q4 2026.
HIPAA
HIPAA safeguards are being put in place, with a Business Associate Agreement available from Q4 2026.
How your data is protected
Encrypted in transit and at rest
TLS between readers, the platform and every provider, database connections included. Stored data is encrypted at rest, and Git credentials and deploy secrets are encrypted again by the application.
Isolated per organization
Every query is scoped to your organization, stored files are partitioned by organization and site, and search and vector data sit in a namespace of their own.
AI that never trains on your content
Model providers receive only what a request needs and may not train on it. Ask AI conversations are not stored, and Ask AI is protected by rate limiting and bot detection.
Least-privilege staff access
Only people who need production access have it, on individual accounts with multi-factor authentication, bound by confidentiality and trained when they join.
Separate, backed-up infrastructure
Production runs on its own infrastructure and credentials, and its data is never copied out. The database is backed up automatically, logs are collected centrally, and every change ships through version control.
Incident response
Defined procedures for containment, root cause and corrective action, and notice to you within 72 hours of us learning of a breach that affects your data.
Controls in your hands
- Public, private or partly private sites, with readers signing in by password, JWT, OAuth 2.0 or their Documentation.AI account
- Roles carried in the reader's JWT or OAuth token decide which pages and groups each reader sees
- Ask AI answers from protected pages and sources only for signed-in readers, within their roles
- API keys with viewer, editor or admin access and an expiry date, rotated or revoked at any time, and MCP credentials limited to the roles you give them
- Workspace members as admins, editors or viewers
Password protection comes with the Standard plan; sign-in over JWT or OAuth and roles come with Pro.
Documents and contacts
Data Processing Addendum
GDPR terms, Standard Contractual Clauses, and the security measures in Annex II.
Subprocessors
Every provider that processes customer data, what for, and where, with 30 days notice of changes.
Privacy Policy
What we collect, why, how long we keep it, and your rights over it.
Report a vulnerability
Found a security issue? Contact us with the details and we will respond promptly.
Frequently asked questions
What security reviews ask us most.
Is Documentation.AI SOC 2 compliant?
Not yet. We are going straight to SOC 2 Type II with Scrut, and the observation period begins in Q4 2026. We will publish the status here when the report is issued, and can share our current security documentation in the meantime.
Is Documentation.AI GDPR compliant?
Yes. We act as a processor for your content and offer a Data Processing Addendum with Standard Contractual Clauses for transfers from the EU, the UK and Switzerland. It is published at documentation.ai/legal/dpa.
Do you sign a BAA for HIPAA?
Not yet. HIPAA safeguards are in progress, and a Business Associate Agreement will be available from Q4 2026. Until then, do not put protected health information in your documentation.
Is our content used to train AI models?
No. Model providers receive only the content needed to answer a request, they are not permitted to train on it, and Ask AI conversations are not stored by Documentation.AI.
Where is our data stored?
In the United States, on Render, Vercel, Supabase and Cloudflare. The subprocessors page lists every provider, what it processes and where, and we give 30 days notice before adding one.
Can we make our documentation private?
Yes. Access Control makes a site public, private or partly private. The Standard plan adds password protection, and Pro adds sign-in through your own login over JWT or OAuth 2.0, with roles that decide which pages each reader sees.
How do we report a security issue?
Contact us at documentation.ai/contact with a description and the steps to reproduce it. Please give us a chance to fix the issue before disclosing it publicly.
Running a security review?
Questionnaires, policies and our DPA, from the team that builds the platform