Information Security Policy

This Policy establishes the information security principles adopted by Doconti to protect the confidentiality, integrity, availability, and resilience of the systems, documents, and data processed through the platform.

Security is an integral part of the architecture, development, operation, and maintenance of the services.

Doconti undertakes to implement measures that are proportionate to the nature of the data processed, the risks identified, the state of the art, and the applicable legal obligations.

This Policy covers:

• Hosting and storage infrastructure;
• Web application and access interfaces;
• Databases and document storage;
• APIs and integrations;
• Artificial intelligence systems;
• Identity and access management;
• Development and maintenance processes;
• Backups;
• Monitoring and incident response;
• Authorised personnel and service providers.

3.1. Security by design

Systems shall be designed and developed in accordance with the principles of data protection by design and by default.

3.2. Least privilege

Each user, employee, or technical service shall only possess the privileges strictly necessary for the performance of their duties.

3.3. Data segregation

Data of different Clients shall remain logically segregated through appropriate authorisation and isolation mechanisms.

3.4. Confidentiality

Access to documents shall be restricted to authorised persons or systems and subject to statutory and contractual confidentiality obligations.

3.5. Traceability

Operations relevant to security shall produce audit logs proportionate to the purpose and risk.

3.6. Continuous improvement

Security measures shall be regularly evaluated, remediated, and updated.

4.1. The platform shall use appropriate authentication and protection mechanisms against unauthorised access.

4.2. Credentials are personal and non-transferable.

4.3. Client administrators are responsible for granting, reviewing, and revoking access permissions granted to their organisation.

4.4. Privileged access by Doconti operators shall be limited, justified, controlled, and auditable.

4.5. The use of multi-factor authentication shall be required for administrative and privileged access, and made available or required for other users in accordance with the risk assessment.

4.6. The platform shall implement session protection measures, limits on authentication attempts, and revocation of compromised sessions.

4.7. Access to an account does not permit the viewing of data belonging to other organisations, except upon express legal and functional authorisation.

5.1. Communications between users and Doconti services shall use secure cryptographic protocols, namely TLS in supported and appropriate versions.

5.2. Documents and databases shall benefit from encryption at rest, with secure key management and segregation of privileges.

5.3. Credentials, tokens, and other technical secrets shall not be stored in public source code or exposed in application logs.

5.4. Doconti shall implement mechanisms to restrict unauthorised access to documents, including permissions validation prior to each relevant operation.

5.5. The use of temporary links for uploading or viewing files shall comply with expiration and authorisation rules.

5.6. Data used in testing and development shall be synthetic, anonymised, or adequately protected, avoiding unnecessary recourse to real production data.

6.1. Doconti shall implement appropriate mechanisms for file type validation and protection against malicious uploads.

6.2. The acceptance of a file does not constitute confirmation of its authenticity, tax validity, or legal integrity.

6.3. Duplicate detection, automatic classification, and information extraction features constitute support tools and do not eliminate the need for professional validation.

6.4. Integrity mechanisms and change logs shall be proportionate to the features made available.

6.5. Doconti shall ensure that identifying an entity by NIF does not, on its own, constitute an authentication mechanism or proof of legitimacy to access documents.

7.1. Access by AI systems to content shall be limited to the documents and data strictly necessary for the requested operation.

7.2. Integrations shall use protected channels and secure authentication mechanisms.

7.3. AI providers shall be subject to risk assessment and appropriate contractual terms.

7.4. The Client shall be informed of the use of AI whenever such information is legally or contractually required.

7.5. AI mechanisms shall not possess unlimited permissions to read, edit, export, or delete documents.

7.6. Doconti shall consider risks such as prompt injection, data leakage, incorrect classification, fabricated responses, and abusive use of computing resources.

7.7. Automated outputs shall be treated as information subject to validation.

7.8. The use of documentary data to train general AI models does not form part of the standard contractual purpose of the service.

8.1. Doconti shall select technology suppliers taking into account security, reliability, data protection, and operational continuity.

8.2. Suppliers processing personal data shall be subject to the contractual instruments required by the GDPR.

8.3. Doconti may use shared cloud computing infrastructure, provided that appropriate segregation and security controls are implemented.

8.4. The location and international flows of data shall be documented and evaluated.

8.5. Material changes to data processing suppliers shall be managed in accordance with the Data Processing Agreement.

9.1. Doconti shall maintain a backup strategy appropriate to the contracted services and identified risks.

9.2. Backups shall be protected against unauthorised access and subject to defined retention periods.

9.3. Recovery procedures shall be periodically tested.

9.4. Recovery objectives, where contractually guaranteed, shall be set out in a specific service level agreement.

9.5. Backups are intended for the technical recovery of the service, and do not necessarily constitute a permanent individual document archive accessible at any time.

9.6. The Client remains responsible for complying with its own archiving and business continuity obligations.

10.1. Doconti may retain logs of operations relevant to security, administration, and auditing.

10.2. Logs may include user identifiers, operations performed, access timestamps, IP address, operation status, and necessary technical information.

10.3. The full content of documents shall not be included in technical logs where this is not necessary.

10.4. Access to logs shall be controlled and limited to authorised personnel.

10.5. Retention periods shall be defined according to criteria of proportionality, risk, and statutory obligations.

Doconti shall maintain appropriate procedures for:

• a) Code management and review;
• b) Access control to repositories;
• c) Dependency and vulnerability management;
• d) Appropriate separation between development, testing, and production;
• e) Security testing proportionate to risk;
• f) Application of updates and patches;
• g) Management of secrets and credentials;
• h) Review of permissions of external services;
• i) Recording and remediation of identified vulnerabilities.

12.1. Identified vulnerabilities shall be classified according to potential risk.

12.2. Critical vulnerabilities shall receive priority remediation.

12.3. Doconti may apply urgent updates without prior notice when necessary to protect the system.

12.4. Offensive testing, exploitation of vulnerabilities, or disclosure of third-party data is not permitted without express authorisation.

12.5. Responsible reporting of vulnerabilities may be carried out via [Security e-mail — to be completed].

13.1. Doconti shall maintain an incident response process comprising the following stages:

• Identification and classification;
• Containment;
• Investigation;
• Mitigation;
• Recovery;
• Documentation;
• Communication, where legally required;
• Evaluation and improvement of security measures.

13.2. Where an incident involves personal data processed on behalf of a Client, Doconti shall notify the controller without undue delay after becoming aware of the breach.

13.3. Communications may take place in phases, as verified information becomes available.

13.4. Doconti may adopt urgent and proportionate isolation, suspension, or access revocation measures to reduce risks.

13.5. The Client shall cooperate in the investigation of incidents involving credentials, devices, or permissions under its control.

Users shall:

• Protect authentication credentials;
• Avoid using compromised devices;
• Keep their respective systems updated;
• Not share private links or access tokens;
• Revoke unnecessary access permissions;
• Report suspicious activity;
• Avoid sending excessive personal data;
• Confirm the identity of recipients before transmitting documents;
• Comply with the permissions and policies of the accounting firm.

15.1. Access by Doconti personnel shall be subject to authorisation and confidentiality obligations.

15.2. Viewing of Client content by Doconti personnel shall only be permitted where there is a legitimate need related to authorised support, maintenance, security, legal obligation, or another permitted purpose.

15.3. Privileged access shall be technically controlled and logged in a proportionate manner.

15.4. Access to content may not take place out of mere curiosity, convenience, or commercial exploitation.

16.1. Doconti shall endeavour to maintain proportionate measures for operational continuity and disaster recovery.

16.2. Temporary interruptions may occur due to maintenance, infrastructure failures, external services, or extraordinary events.

16.3. In the absence of a specific SLA, this Policy does not establish any guarantee of uninterrupted availability, fixed recovery time, or automatic compensation for unavailability.

16.4. Doconti shall provide incident and availability information required contractually or by law.

17.1. Doconti shall carry out proportionate assessments of its security controls.

17.2. Whenever legally required, it shall provide sufficient information to demonstrate compliance with data protection obligations.

17.3. Audits shall be conducted in accordance with the procedures of the Data Processing Agreement, safeguarding the confidentiality, security, and rights of other Clients.

17.4. External certifications shall only be announced once actually obtained and valid.

This Policy shall be reviewed periodically and whenever material changes in risk, architecture, legislation, or operations occur.

Contact for security matters: [Security e-mail — to be completed]

Reporting of vulnerabilities: [Security e-mail — to be completed]