Security

Subdoc handles sensitive investor data, subscription documents, and e-signatures. Every layer of the platform is designed to protect that data.

Compliance & Testing

SOC 2 audit underway. Our SOC 2 Type I audit is in progress with an independent auditor, with Type II to follow.
Independent penetration testing. A third-party penetration test is performed at least annually. The most recent, in September 2026, found no critical or high-severity issues. The report is available under NDA.
Automated scanning. Vulnerability scanning and dependency auditing run on every code change and on a weekly schedule.

Audited providers. Hosted on managed cloud infrastructure from providers with SOC 2 Type II reports.
Environment isolation. Production, demo, and development each have their own database, credentials, and deployment pipeline.
Encryption at rest and in transit. All stored data, including the database, documents, and backups, is encrypted with AES-256. Every connection is encrypted with TLS.
Backups and recovery. The database is backed up daily, and both the database and every document are copied nightly to a separate provider, where each copy is kept unalterable for 365 days. Restores are tested annually.

Multi-factor authentication. Sign-in requires a second factor by default, enforced on the server.
Role-based access control. Granular, default-deny permissions are enforced on the server for every request. Each fund's data is visible only to the people connected to that fund.

Input validation. All inputs are validated and database queries are parameterized to protect against injection attacks.
File validation. Uploaded documents pass multi-layer verification before they are accepted.
Fund-isolated storage. Each fund's documents are stored separately and encrypted.
E-signatures. Signing runs through an audited e-signature provider, and every status update from it is verified before it is accepted.
Identity verification (KYC/AML). Configurable per fund and handled by a SOC 2 audited, ISO 27001 certified provider.

Access-scoped AI. The assistant can only retrieve what the signed-in user is already entitled to see, and every language-model request runs inside Subdoc's own private cloud project.
No model training on client data. Our AI providers contractually commit to not using client data for training.

Audit trail. Critical actions are recorded in an append-only activity history that is never edited or deleted.
Incident response. A structured process covers detection, containment, investigation, client notification, and remediation.

For our detailed Security Whitepaper, Subprocessor List, or to complete a security questionnaire, contact us: security@subdoc.ai