01 VERIFIED CONTROLS
Security claims that stay close to the code.
This page describes controls we can verify in the current source and tests. It deliberately leaves out claims that need separate production evidence.
PUBLIC SECURITY NOTE
What is here Authentication, authorization boundaries, network restrictions and provider-key protection. What is not here Certification, residency, retention, penetration testing, SLA or training claims.02 CONTROL MAP
Boundaries on the path from key to document.
These controls describe the application behavior visible in the repository. They are not a substitute for your own security review of an integration.
- 01TLS at the public edge
The public API is served through the TLS-protected edge that fronts app.docparser.dev.
- 02Bcrypt-hashed API secrets
API client secrets are stored as bcrypt hashes and checked with bcrypt comparison, rather than read back as plaintext.
- 03Immediate key revocation
Authentication selects only API keys without a revoked timestamp, so a revoked key stops authenticating on the next request.
- 04Organization-scoped retrieval
Document retrieval filters by the authenticated organization and the supplied consumer reference.
- 05Cross-tenant 404
A record outside that organization does not resolve through the retrieval route; the caller receives a cross-tenant 404.
- 06IP allowlisting
An organization can restrict an API key to configured IP addresses or CIDR ranges after credential verification succeeds.
- 07AES-256-GCM provider vault
Provider credentials are encrypted in the verified vault with AES-256-GCM, a fresh per-record IV and an authentication tag.
03 PROVIDER VAULT
Encrypted material, authenticated on decrypt.
The provider-credential vault stores ciphertext, an IV and an authentication tag. The server-held master key is required to decrypt it, and altered material fails authentication rather than being accepted as a credential.
04 INTEGRATION REVIEW
Start with the documented request and retrieval boundaries.
Use the API documentation to review authentication headers, webhook constraints and the organization-scoped retrieval path before connecting a production system.