Security & trust
Walls first. Receipts always.
DocML is built for firms whose regulator, clients and NDAs all assume the same thing: deal information never travels. Every agent works inside walls it cannot cross — enforced structurally, not by promise.
The deal wall
Every agent query is scoped to one deal in SQL. A citation from another deal cannot resolve — by construction.
The firm wall
Another firm's deals, runs, templates and keys return 404 — existence never leaks. Workspace sign-in keys are stored as one-way hashes: checkable, never recoverable.
Audit trail
Every material action and approval — human or agent — lands in a tamper-evident, append-only log: each record is hash-chained to the one before it, so an edited or deleted row breaks the chain and the verifier names it. Exportable per firm in one call. Tamper-evidence protects history from silent alteration — it is not a promise of permanent storage.
Retention & deletion
Deleting a deal is complete and immediate: documents, runs and rendered artifacts go; only the audit history of who did what remains. Audit records are retained under DocML's current pilot retention policy — customer-configurable retention and legal holds are planned for enterprise deployments.
Gates that fail closed
Audit agents run at the export door: an untraceable figure or a missing section blocks the package. A gate that cannot run never waves a document through.
Data residency by deployment
Pilot deployments run single-instance on the infrastructure you choose — in-India for Indian desks, so deal data and inference stay in-country. Offshore models are used only by explicit consent. Certification (VAPT) is scheduled with the pilot program, not claimed before it.
Your models, your keys
Each firm controls which model providers DocML may use. Provider credentials are encrypted at rest under the deployment's key secret and decrypted only inside the provider-call path. They are never displayed after registration and are excluded from prompts, exports and audit logs. A database stolen without its secret refuses to run.
Humans hold the gate
No agent ships a document alone: a named approver signs off, rejections are terminal, every decision audited.
Pilot deployments run single-instance with your data on your infrastructure choice. VAPT and certification work is scheduled with the pilot program.