Security at Docent

Hosting & architecture

Docent runs on Microsoft Azure in United States regions — the application on Azure Container Apps, data in Azure Database for PostgreSQL and Azure Blob Storage. All traffic is HTTPS with TLS 1.2 minimum enforced end to end; the storage layer refuses plain HTTP entirely.

Sign-in and access

There are no Docent passwords to steal: dashboard sign-in is Microsoft Entra ID (your existing Microsoft 365 identity, your conditional-access policies, your MFA), through our publisher-verified app registration. Every request is authorized against your organization's membership — role-scoped, with front-desk and admin roles kept apart. Kiosks authenticate with per-device keys you can regenerate in one click (the old URL dies instantly), and can be locked to your site's IP addresses. Repeated probing of kiosk or pairing endpoints earns an automatic platform-level IP ban.

Tenant isolation

Docent is multi-tenant with strict logical isolation: every record is keyed to your organization, and every query and file access is authorized against it on every request. Files live in private storage — public access is disabled at the storage-account level — and are only ever served through the application after that authorization check.

Encryption

Everything is encrypted in transit (TLS 1.2+) and at rest (AES-256, managed by Azure). Government ID document images get a second, independent layer: they are encrypted inside the application with AES-256-GCM before they ever reach storage, using per-organization derived keys held in Azure Key Vault — never by the storage layer. Even a compromise of the storage account itself would yield only ciphertext for ID documents, and their storage paths carry no customer-identifying names. Each image is cryptographically bound to its own visit record, so a file copied elsewhere fails authentication instead of decrypting.

Secrets

Application secrets (database credentials, signing keys, API credentials, the ID-image encryption key) live in Azure Key Vault, accessed by managed identity. They are not in source code, not in container images, and not on developer laptops.

Data minimization & retention

We collect what a visitor program needs and age it out: ID document images auto-delete after 30 days (the verification result stays on the visit record); visit photos and records follow a retention window you configure, purged on schedule. You can export your data at any time, and this website itself sets no cookies and runs no third-party trackers — traffic is measured with anonymous first-party counters only.

Screening, honestly stated

Enterprise-tier screening checks every visitor against the U.S. government's Consolidated Screening List (via the official trade.gov API) and your own ban list, and records the evidence on the visit. It is fail-secure: if screening can't complete, the kiosk holds the visitor for staff review rather than waving them through. Docent is a control inside your compliance program — it does not by itself make you ITAR-compliant, and we won't tell you otherwise.

Software integrity

The Windows print connector is code-signed (Azure Trusted Signing, publisher nXio) and auto-updates only after verifying the SHA-256 of each release against our signed manifest.

Backups & continuity

Databases are backed up automatically every day with 7-day point-in-time restore. Deployments are zero-downtime revisions with instant rollback to the previous image.

Subprocessors

Microsoft (Azure hosting, Graph/Teams/email), Slack (only if you connect it), RUCKUS and Ubiquiti (only if you use their guest Wi-Fi), and trade.gov (screening queries). The full list and data roles are in the Privacy Policy.

Where we are on audits

Docent has not yet completed a third-party audit such as SOC 2 — we're early, and we'd rather tell you that than imply otherwise. We're glad to complete your vendor security questionnaire, walk your security team through the architecture, and we plan certification as customer requirements warrant it.

Reporting a vulnerability

Found something? Tell us at security@docentvms.com and we'll respond quickly. We ask for reasonable disclosure time and won't pursue good-faith research.