You handle other people's confidential documents. Here is how DocMold keeps them that way.
Every template, client record and generated document belongs to exactly one workspace. Data access is scoped to the workspace on every request, at the database layer - not just in the interface.
Workspace owners invite team members with specific permissions. Sessions are short-lived signed tokens that can be revoked instantly on sign-out or by an administrator.
All traffic is HTTPS with HSTS. Sensitive stored values such as mail credentials are encrypted at rest with a dedicated key; passwords are salted and hashed, never stored in clear.
Every generation, download, edit and sign-in is recorded with who, what and when, and template versions are kept so any past document can be reproduced exactly.
Marketing communication is strictly opt-in with a recorded consent timestamp and source, in line with India's Digital Personal Data Protection Act. Your clients' data is processed only to produce your documents.
Card and bank details never touch DocMold servers. Subscription payments are processed by Razorpay and webhooks are signature-verified.
Found a vulnerability or have a security question? Email support@docmold.com with the subject "Security" and we will respond promptly.